{ "Event": { "published": true, "date": "2023-08-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-07", "timestamp": 1691452981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1b4d2ee8-5d9b-476c-9eb5-1906c6e93dc4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f4f07a-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691394607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394607, "uuid": "cd66c44c-4e3d-40a4-bcd5-6126b7dcd733", "comment": "Malware payload (Mirai)", "value": "d61f2bb073e1efad5cce218429462afa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394607, "uuid": "b65efa7e-de31-4f6c-ac5b-d84b06bacba7", "comment": "Malware payload (Mirai)", "value": "018b4ba819f35a07777be6a334d9e6e41c06d6719f63b13ac0da5bd962c2f694", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394607, "uuid": "a4023fec-a73f-41b7-94de-850611dae800", "comment": "Malware payload (Mirai)", "value": "dd1c7ca51bcb94fea1d3cfc0d8767b3bac398b68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394607, "uuid": "46a88a8d-e9f1-40f7-8c06-059ceb5cfcc8", "comment": "Malware payload (Mirai)", "value": "e5eaff5b323c59b7e2d0aafbe9c85441600e30979f90d79a2e07d6221a99a67e4e76eedd427271ae05e4f77e89aad85a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394607, "uuid": "e9840c81-1fc7-44b5-a61f-90aaf55c35ae", "value": "T159C2D07093EA1CB5C3600672F7B856C6BB534FBDFAFD2C90214047BA39429152ADA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394607, "uuid": "35da02aa-97b0-4876-a8d7-20074b0fa430", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEyb0OhymdGUop5hw:A7soTAZ3alkXLvFh8nNEgXs3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394607, "uuid": "e3eeb3d8-e9e6-43f4-9f2a-a1a2a928d865", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394607, "uuid": "2716ed74-965a-4840-9148-d0175e1c865a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394607, "uuid": "bdb3ba7b-b60e-4f43-9f96-a86fd34029cb", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e48976c-355f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691439448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439448, "uuid": "11c14d21-7e9b-4815-937f-158db1723e8a", "comment": "Malware payload", "value": "5d3b0487920d9658063cd3d7f4b1fcac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439448, "uuid": "9b60f2d5-23f4-4c78-a51f-3978165ccc71", "comment": "Malware payload", "value": "03c606e318f2954586aa20274b2ea9733fdc5f6c10b8e2372216f8c71c4e7205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439448, "uuid": "12d78203-767f-4281-a286-b9797d113ccc", "comment": "Malware payload", "value": "5233349326ca6d69b32819091255709f84088a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439448, "uuid": "01c6e83c-8a89-4542-b493-7684bc8c0b76", "comment": "Malware payload", "value": "266f56c138dc02531d0b5696cb1794b1a5424c500efd07740f86882e50aedea069410713b976bb91977653e7b27613c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439448, "uuid": "acc1e309-f237-4660-bbfa-0ef7a80e15e9", "value": "T10245335A2C87E73DC90E26F14DA39595C2F1BA316C30CEAECA2C4C872F587A5659C0E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439448, "uuid": "96e35dc6-487c-4ea5-be17-7fecd5395e22", "value": "ccae7705d3bafed6b8f5ee79b27d03ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439448, "uuid": "925a50a6-ddd7-483c-923f-0c0c3d7052fe", "value": "24576:tOjVxxl3D0M5OBdcqeTxes0W2OC24/NnPFky127TuPEjQOVD4COpDCDZ:UxxDx5Wc0Z5OTwpWy12PuPGV0COpDCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691439448, "uuid": "326f273c-d4fb-422e-88f4-20710577935b", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691439448, "uuid": "7996b157-84fd-4101-a3c0-fa9f9c386c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439448, "uuid": "283af012-3c30-47d8-a507-6acb2721dcd8", "value": "03c606e318f2954586aa20274b2ea9733fdc5f6c10b8e2372216f8c71c4e7205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5623caed-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414497, "uuid": "eaa51b70-7b42-4df4-9e97-1002a312869b", "comment": "Malware payload", "value": "c48c4aa77996b661fdccafb82500126a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414497, "uuid": "ce74e141-5a2b-479f-973f-8ea7ded55a70", "comment": "Malware payload", "value": "03ccbda7d7f365fbe412f8fa009ddb0bea8a3af39b55808f6ec32e277466ed75", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414497, "uuid": "6674c03d-714d-4de9-8b8c-ce0c81534b73", "comment": "Malware payload", "value": "f280ab915b4d1d83ba2dd70d849cb3d257ea52cd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414497, "uuid": "101edda7-72f7-47c7-9989-91a80239d7cf", "comment": "Malware payload", "value": "02f40334fa7e554f96b30ef28d9375fef99c84407e1fa18d726e023a4f4bfb55b6ee06c033e6e05c987a9f334f8251ef", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414497, "uuid": "6af0ef96-1615-40de-b582-9dfc50c99485", "value": "T1B7E423968EE70E57A653602B8BA9F1157BD3FFA71B02F546A875734E1E211CE030220B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414497, "uuid": "f4aeea17-ba46-4d16-9a16-2b8462f92cce", "value": "12288:2EQfGk2wJW+oJj3EVKMzxKScE9IXtiMqgSVXjulM3yR5t:2EFkwbmKM5c/XLqNAM3yR5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414497, "uuid": "813f83e9-bf05-443e-8743-b9e00bd11b2e", "value": 663910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414497, "uuid": "587acf6f-0823-4149-bdc2-5709800fc108", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414497, "uuid": "07e2ff96-6241-4df5-9c7b-05ac3d4dfcfe", "value": "Quotation For Products.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e61dfc-3510-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691405524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405524, "uuid": "44570ed5-d783-42fa-9811-be0a113c4d8c", "comment": "Malware payload (Formbook)", "value": "645369bf20bfde70c6f173a03190b14d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405524, "uuid": "20decc4d-d675-45bd-944e-c2452cbd77f4", "comment": "Malware payload (Formbook)", "value": "03e156f16efbda2a891a6519a282ad085325d498695287ee92ad056f7d1c2422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405524, "uuid": "4ac4d7d9-9c5a-4c09-82c2-bd87ac17abfe", "comment": "Malware payload (Formbook)", "value": "306dbbfef97fc4c2ac738a7ef80bc5dbcb7fdbf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405524, "uuid": "f1ac1e28-b442-49f7-8428-60e811577736", "comment": "Malware payload (Formbook)", "value": "f8bbf54a5bf3a3a727b996b572f42a7ce58d5e0d62c2d13aa5742c27c8c139024a2a501d194d42518089303dcb38d1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405524, "uuid": "3ae24ad4-6f00-4fbd-a055-dc38f474c2bb", "value": "T187C4120832ECDB95FDB947F9696CA26903A6B26D4524F35C9F411CDF2866F0A8E01F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405524, "uuid": "8ff429ba-c372-4228-9581-aae6b7941080", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405524, "uuid": "5b44b3ca-fd38-42ad-a06f-ba54fe09befb", "value": "12288:Fn1ap+yrcpjJrucrUgLwO0bl7ubknCOvPv1FquP6m8VxgERF:p1y+ywpNS0jLMl7ubkBPqU6lVmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405524, "uuid": "2f47e51b-3986-4e9b-93d1-e7069eae3167", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405524, "uuid": "ed1d13e0-72a8-45e5-b5ce-16cc6235c16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405524, "uuid": "1de07249-efab-4a6a-aa62-92221a2a3f98", "value": "obizx.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6991ed6d-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400356, "uuid": "4649f523-b37c-4af8-93ab-56c52deebc2e", "comment": "Malware payload (DarkCloud)", "value": "71e6d773217348f3280be18bec012da1", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400356, "uuid": "0f5d3ba3-7baa-42ee-bcfe-cc6ae930341e", "comment": "Malware payload (DarkCloud)", "value": "0523052bf426e3dbb3228f134bc10745a25c51e58b9cc8fffd1c6832901fd84e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400356, "uuid": "d934c300-e10b-41ab-a5df-4f944ff6623e", "comment": "Malware payload (DarkCloud)", "value": "fbc1ef827557e40ea29569b9b0eadc10dbd60c82", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400356, "uuid": "894c14f6-31d9-4ab4-a5ba-ba3a900b7716", "comment": "Malware payload (DarkCloud)", "value": "efe545ea122d4bdcb1a67a7e86e009666207bc4dd06b94d52d7729d007fec59532875cb6bb87d70bd11a7f1368ef2f9e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400356, "uuid": "8988e287-5b37-4d98-9268-d1601e2a1a23", "value": "T1A9844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400356, "uuid": "59dbfa82-0abe-49ec-952f-8e9ba18d2e45", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400356, "uuid": "0b26bf74-51b6-457d-be86-64f10067e823", "value": "6144:Phys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:Phys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400356, "uuid": "b1e99068-9a50-41f1-98c6-cd9cc5295c69", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400356, "uuid": "08015207-fc22-438b-9fb6-430be82bd216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400356, "uuid": "eb2d91ff-f602-43d6-b3e6-7bb3e283049d", "value": "0523052bf426e3dbb3228f134bc10745a25c51e58b9cc8fffd1c6832901fd84e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62abf4fe-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691394761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394761, "uuid": "d4cfc497-c703-4a53-bdd4-e47db234c144", "comment": "Malware payload (DarkCloud)", "value": "3db7d4db7a36da520ff4ab1730532aab", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394761, "uuid": "028add27-6a03-472d-a6ea-4e7edfa28953", "comment": "Malware payload (DarkCloud)", "value": "057c0c77df51251e2d0067c044f3c64933478c536963e3e7eb29d7e9b5ccd446", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394761, "uuid": "dced59ed-c3ca-4435-b98c-ca1d5b498607", "comment": "Malware payload (DarkCloud)", "value": "eb2e994b8929d1d59fec2c8d20a40edc67fbe063", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394761, "uuid": "43c9a88c-30bb-4428-b780-309cd4fe069c", "comment": "Malware payload (DarkCloud)", "value": "72569c7f2fcd5d4c56fe4d8eb55db2168403a0f6b8cf91dee6bf821be44cb35d88e5d49a03d83930edeceec71d357180", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394761, "uuid": "4c6aff2d-757e-47af-aae8-566a19a07510", "value": "T1C5944B1AFE10782AF5A3C8B1BAA4E21BAC156D3E1640AC1BF7815F4935355D3A4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394761, "uuid": "ca2969df-0211-4011-b123-3d9b348d1c03", "value": "52822505614761b7e35cb6535b24558f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394761, "uuid": "50fe83ba-7949-4759-8fcf-04385252986b", "value": "12288:uiZzJu0Gy71JPqpxBn30LGAeKYo+jYKkJj6GmZU:BZ371LCKYoAYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394761, "uuid": "77673328-330e-43a5-a455-ad5193b2288e", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394761, "uuid": "e6ed27d8-103a-4f6f-86d5-ad328aa0f263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394761, "uuid": "d6cf6f19-ab67-4197-abfb-a3b0675d461c", "value": "057c0c77df51251e2d0067c044f3c64933478c536963e3e7eb29d7e9b5ccd446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac697d85-34c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691374698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691374698, "uuid": "5fae0f47-0b91-4343-8cca-ae6b0a282747", "comment": "Malware payload", "value": "a0bb6319c57c119ef3da9a1051c10d55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691374698, "uuid": "52a38028-3fff-4437-8303-a9e0bc3a6e65", "comment": "Malware payload", "value": "059c9fcc57ce4fcb5742706ac9331a94d07a023b9d131c6b9974315c2adf414b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691374698, "uuid": "34fdeabd-c1dd-4e7b-8e64-80ef8687e3f2", "comment": "Malware payload", "value": "719dcd06c5f03811a4271a432fec813a8c36ff94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691374698, "uuid": "4504a1bb-ab3c-4bbc-9fc6-0857e65c0ffc", "comment": "Malware payload", "value": "4acd8902ef1387fc5fe6334d6d5273c6ed34d03b02ae045cb956ab00316d5edb85f98f321a7c16fcd54bb6b2938dd514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691374698, "uuid": "a660ebc1-a689-46e6-9d00-4ad055c4aab3", "value": "T19942645766859D37D0AA163125C38379B236D831CA41AF1BB70C119D3E83BEC6B31BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691374698, "uuid": "e9acfb24-353a-4af1-84aa-c4605b835a3c", "value": "192:FSx4DHEGFeX8PBneH3HcsIUYvK6fUWCAjAiYAw7iPuKVv:FI4DkyzNUYvNRsiFw+mKVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691374698, "uuid": "9487f1dc-be3e-4f9e-adc3-3d1c5756343c", "value": 12896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691374698, "uuid": "ef334958-3a58-4a6d-b145-d322244fe657", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691374698, "uuid": "949c763b-babb-427b-a7d2-a30f0539c9a2", "value": "a0bb6319c57c119ef3da9a1051c10d55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73687214-355e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691439027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439027, "uuid": "c22a67e8-76ef-4e62-a9c4-b9315fdfb2a4", "comment": "Malware payload", "value": "75150e258c3690ea2db3c4c3ef8e85b5", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439027, "uuid": "a776b6b8-fed1-4a22-ba5f-0568b43c1054", "comment": "Malware payload", "value": "06a24f7513c4a8d046ce2cdd84ce1e55dc4efbb54d1cff7852342f999b5cb45d", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439027, "uuid": "9d4be8aa-f3cf-4bc0-be33-b6d0255c807e", "comment": "Malware payload", "value": "26c0abe103bba288dff7888e1ef9eebdf059d68d", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439027, "uuid": "0bd4b50c-4849-49ca-80e3-dd0b0a557c96", "comment": "Malware payload", "value": "0fc8c2928a0bf4326bed0439b9b2d535dfa58f7767d1fcefb80f306df18fa5623fa1790eb54c45a098429a1290745cfa", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439027, "uuid": "37937a1b-1bb7-409a-9fab-ab523c76c39d", "value": "T1C523BF79E68E2C6CE8C3C737827B388D012EB67657D87A52B9B04B45A81C489B1C35D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439027, "uuid": "f29011f9-a0ee-4e9d-b4e2-c8fc4db04407", "value": "768:96V0KG+hKi+RYtFpHmTZEqA5yatxNbi3V2xLgbm7RuWYeN4PaRrS43AWNPgX:966bQa25HmtEhrJM+LgbmluWYeS43DgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691439027, "uuid": "57e1c358-35aa-4957-a808-34403d5320f8", "value": 49547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691439027, "uuid": "d52f093c-0b7d-4d7d-86e9-aa9c29387056", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439027, "uuid": "9f369783-3cdc-4e37-adce-857c3cb233a3", "value": "washingtons-views-on-foreign-affairs2.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cfa488-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691381316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381316, "uuid": "63911e59-24fa-4c40-85e7-7cd736bcb4dc", "comment": "Malware payload (Mirai)", "value": "43d4e7ecf23c4ce80cc50b6ab12facbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381316, "uuid": "be1cbd86-25a1-460c-af12-fec66bcaf4f3", "comment": "Malware payload (Mirai)", "value": "06d384d6c7fb08b2fae2b95b84d714bb7e555eadfb563390b98763202ebd5a15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381316, "uuid": "a2c615e5-51f6-4f67-a371-57ee81db005e", "comment": "Malware payload (Mirai)", "value": "e554a74e9d1a5fc99f14d8016c2fe4cc98ff200f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381316, "uuid": "c95eb4c9-6554-473d-8fd2-db945bcd89eb", "comment": "Malware payload (Mirai)", "value": "963d1068f9239348a5604ef8bb80183073bcc8b8551e41e32d821d332d58c63e9fbf4b8aa4cec1b727e3fc02637872f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381316, "uuid": "2cd8916f-f38c-41e0-a47b-dd7d7f32f850", "value": "T18E431995FD819A12C5D51177FB6F438C772A0398E2FA32039E2A6F2067878660F37616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381316, "uuid": "055fce3f-cb60-40a8-8dab-d7b54454c5d3", "value": "1536:p38TMnCKvRUjFjahVHidTPyOCTMLDwXBs6Q3qs:VMMnL5Ux+3Hi5R8Xqrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381316, "uuid": "6a5b1d3f-f7fc-40bb-b0b4-4b9282f2af1a", "value": 59492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381316, "uuid": "9f212ace-da36-4598-a657-442503206d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381316, "uuid": "31279e13-16c6-40d4-b5c7-23622d904fe5", "value": "43d4e7ecf23c4ce80cc50b6ab12facbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db9c952-3505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400658, "uuid": "6064f340-427b-46e9-8762-16b5e3d88ec3", "comment": "Malware payload (DarkCloud)", "value": "81f9ef0ad7a89f940d84a211e5bcb1b1", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400658, "uuid": "a90a4e45-912c-4a8a-82c2-713fdd604bca", "comment": "Malware payload (DarkCloud)", "value": "0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400658, "uuid": "0ca1e27a-0eed-401c-b615-8529cf20ea54", "comment": "Malware payload (DarkCloud)", "value": "10bf03b43269337a10965271575dd767d53374b9", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400658, "uuid": "79cd60a8-ef61-4060-a0fe-2f5cbaa41162", "comment": "Malware payload (DarkCloud)", "value": "fe36744cfa7c1d3515bc9c6ca8bf1ea2a35ffcbbcd3dae7d0138ab9e110396ece59f2ed8244df3ce7d33bc0d243d7b88", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400658, "uuid": "aa2460e7-532e-43f0-ad73-6f4a17cd8efd", "value": "T123844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400658, "uuid": "7ebbc42f-a21c-4acc-bfd4-93e757273f37", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400658, "uuid": "d030a3dc-d144-449c-831b-4787c18e6a8e", "value": "6144:ehys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:ehys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400658, "uuid": "834e8cd7-2395-45f7-91e3-9189a983431b", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400658, "uuid": "dc03ea0c-d18d-42fc-99c3-06c23bd14fac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400658, "uuid": "297c30f8-b5f1-4426-b8ef-ea91cfd45520", "value": "0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dd48af-3505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400744, "uuid": "e1cb420d-b2c9-41a6-87b9-44c45391bc77", "comment": "Malware payload (DarkCloud)", "value": "d47402aa5406a79ae1f678b599ded9a0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400744, "uuid": "a380a71c-99e0-49d4-ac63-cbaba8b98986", "comment": "Malware payload (DarkCloud)", "value": "077ae2aeb18247f9f8da56b3854e7e54343a25130727817233f1bf2860bd445e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400744, "uuid": "3ac7e8d4-f663-4609-84ce-9a095b3c79ca", "comment": "Malware payload (DarkCloud)", "value": "6fcf818f0d1fe92e7f6905e0236f375a4c5826ff", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400744, "uuid": "48f41f60-af43-46dc-9cda-6e9c5f1d1cce", "comment": "Malware payload (DarkCloud)", "value": "c08bb036d837266ccd76a5001ee4f7dc617542c903fce50192bfb03224c4c4423042757a55a47c47485a8597241d2242", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400744, "uuid": "67098589-512b-4013-9625-350901ab37c6", "value": "T1B9844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400744, "uuid": "8f85a543-4748-4fa1-a882-5086ad27f0b4", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400744, "uuid": "1ca50c24-88e3-439e-97f4-51b7825222a2", "value": "6144:khys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:khys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400744, "uuid": "6c86dcdd-a3ca-4732-95b0-25aaf3e74352", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400744, "uuid": "8d08f94a-60b3-4d18-9e82-6a99c9c1a31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400744, "uuid": "f96ce1d1-cf27-431a-b466-ace6d04f211e", "value": "077ae2aeb18247f9f8da56b3854e7e54343a25130727817233f1bf2860bd445e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d37b91-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691414707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414707, "uuid": "b62a7ca1-27b4-47da-aedb-67e570de73eb", "comment": "Malware payload (RemcosRAT)", "value": "2e1389c05305bfb354d2ccf7856d12d2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414707, "uuid": "71998d8b-a419-439b-9741-874bfe6bb72c", "comment": "Malware payload (RemcosRAT)", "value": "08b6cbf2dac8c2511f493b007cd6e3dc962bd9fbf9f2b397d59526e9a4bbb32f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414707, "uuid": "1af53f9a-596b-411f-8ba0-19d3e8b9a549", "comment": "Malware payload (RemcosRAT)", "value": "9d3566dbb1ef57e95442be2bea1e3202ab1494d6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414707, "uuid": "a02eb854-7245-4c2f-92df-089d38af21fc", "comment": "Malware payload (RemcosRAT)", "value": "315175580314982b78c8a5e3507111fa8cff2963cf85d5177a668beaa6398c86d6dc76465a768058f55eb6f659e17353", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414707, "uuid": "97555822-afdc-4469-8386-5444dd377b2b", "value": "T1D7517D041BE90721F3B79E77567B52118877B801DA756B0E008C42C82B2BB11A865F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414707, "uuid": "23cdc238-b17e-44cb-b413-0b550c1010fb", "value": "24:8AGJtnyUlVefFJiFnohLSdd79ds5/f3s:8/8IFnotSdJ9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414707, "uuid": "66733fc8-598f-445b-bb15-5b587611f064", "value": 2804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414707, "uuid": "b381cd37-5e47-434e-93f5-7f6980b0b95d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414707, "uuid": "9d95176a-a6c6-4955-a11f-75c724429883", "value": "payment.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b56368-34da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691382227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382227, "uuid": "d8c83a47-c118-4781-9c14-d19d669a08eb", "comment": "Malware payload (RedLineStealer)", "value": "bb6c836b90e6245646e07af2ec225e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382227, "uuid": "282e3a6c-d8cc-4d53-b8ef-33e10a023f77", "comment": "Malware payload (RedLineStealer)", "value": "096ce9d0b724b551b98d226fdf21dfaa731606e0d2cfd8f259fe09db24e6e15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382227, "uuid": "0fd3ef9e-ca94-4a08-8ab1-89c5bc01b10c", "comment": "Malware payload (RedLineStealer)", "value": "5df975600d2b335f97c11933314d4db3ae2663fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382227, "uuid": "0d58d909-34ca-4a58-8a75-58822be2590c", "comment": "Malware payload (RedLineStealer)", "value": "719101c35d6d9331fd74a668393d094d34760822276148e970be57678207534d7973b2b4044d7a1dc4c730f1bff959b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382227, "uuid": "01233644-ebda-4462-8098-f50c3b002c05", "value": "T100A4CF1252956871E6375A338E2AC6E4EB1FFCA1FF1577DB22487A2F09701E1C672702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382227, "uuid": "69c5704e-0946-4c15-8038-8a20b2ae25d7", "value": "f6429983d70ccd6d64f4cf8f0424f062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382227, "uuid": "2960da81-8bec-4594-bbd5-c5ca0b359c4d", "value": "6144:uNxKQJDbq2GFPyYg/tCfZu6HjuD6vK8oDD+YzBj7XU:0wQVb7GlyYqtMZXiD6iDfbd7XU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691382227, "uuid": "3a70c59a-7e6e-4e96-b92d-02ab1d405dfd", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691382227, "uuid": "613b05b4-4cd1-4208-a77e-d145084504e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382227, "uuid": "5ab4c38b-233d-47d4-9d03-24d71342aa98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ef4477-3512-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691406554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406554, "uuid": "7892c637-3740-4eb9-a008-ff32a783bc09", "comment": "Malware payload (AgentTesla)", "value": "043f2e3558d96a4e3f403bc7e16d39d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406554, "uuid": "22d33b69-d8a3-4f31-a500-3e3fd5719683", "comment": "Malware payload (AgentTesla)", "value": "098dc7c3c4f9245eb29c1a985442d6cd392858f88b25783bcb68f0e40e2311cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406554, "uuid": "6130beed-0ec5-4225-a0f6-03604c5fe624", "comment": "Malware payload (AgentTesla)", "value": "f4fe0af846130aaf7d49ec0fe0c0df8bb3c7e04c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406554, "uuid": "99fb6652-ee0f-4254-9202-15136645460c", "comment": "Malware payload (AgentTesla)", "value": "788ade8a063e8da099cc103cd6fdb90d5794fe873fcead0669f1cb93314be7ab5f6125f5596392ddf48f42321680be64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406554, "uuid": "04a6d7bb-f97d-4c7b-97c4-7e53ef720e9f", "value": "T1FBF282037E48E726D5883E3B51EF191443B2E1C71273D60BAF88BFA628813935D6976D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406554, "uuid": "a7f5a41a-8504-4ea8-a1c7-3eb776c320b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406554, "uuid": "e8f5fe03-ca8a-4a9e-a35c-6cc20a9e2220", "value": "384:T4mILUUiXD9tOZdp7RFRIRZcvymn78kuLzahUea+zYhBdaPGn5SGgMdxA1MTF23O:MPvXMJfAPG5SXMdzp2ruVhEc4l24iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691406554, "uuid": "d7c9bcf9-9d8b-489b-9340-86feecd182e5", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691406554, "uuid": "6ce85a82-62f5-41cc-b4da-bb79238b3617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406554, "uuid": "50567d60-7c7f-4783-b08a-696b40517513", "value": "098dc7c3c4f9245eb29c1a985442d6cd392858f88b25783bcb68f0e40e2311cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad497b0-34ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691398318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398318, "uuid": "0b9e8ce7-fd3b-40db-9463-620d112571fc", "comment": "Malware payload (DarkCloud)", "value": "597d4775c59efdd500d52c26aa235b4f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398318, "uuid": "0cea2fa6-56fb-422b-bef4-e32d962daba2", "comment": "Malware payload (DarkCloud)", "value": "0b48936f907ab57d10dbb6f61da2d7430708cc8bfb2e3560b0284216c63ccaef", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398318, "uuid": "b7e4acf6-20f9-4092-9ed3-6df19918ed28", "comment": "Malware payload (DarkCloud)", "value": "46e18f88e93095c8901a7bfed0adffd1b42e2e24", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398318, "uuid": "b1101d37-98b7-458b-96cd-55a58d7c7877", "comment": "Malware payload (DarkCloud)", "value": "f222beb0ae14b6e7b3f17f8da99ad4a484472ec639163f01b012e1610e77790db64c58443650d173f1d7789b1baefcc5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398318, "uuid": "32c1706b-d8ff-4949-91c0-ce7e0939c419", "value": "T18EB4182AE660602EF193C8F0E6E562676814BD771288A817F3915F4931365F7B8F132F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398318, "uuid": "5a77d3bc-aeed-4937-a13f-e3c70b715cbc", "value": "12288:baG88NqWx3CMj21piSU+FfUZ6DWn2jYKkJj6GmZUW:zNSTU+FfUZEuYYb6nZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691398318, "uuid": "8f6f2526-51a1-43f0-bc52-a6cb06b50f54", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691398318, "uuid": "db3378c6-96c3-42b0-8a0a-91594ef1ccf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398318, "uuid": "673e98de-83c8-41ad-b000-f0a02e40b54c", "value": "0b48936f907ab57d10dbb6f61da2d7430708cc8bfb2e3560b0284216c63ccaef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dce5649-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414590, "uuid": "84e99ac9-73e0-4e1f-ab8c-63929d48e777", "comment": "Malware payload", "value": "1cece9fd49abd3e71652d7f93247273c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414590, "uuid": "42b746d7-7eaf-4547-a0cf-0c4ed057acfe", "comment": "Malware payload", "value": "0bcd0ac48b5ffde03aa805676fb9f378b257b84fce03b8e724903a0ed5309a07", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414590, "uuid": "29f3d5f5-f47a-47dc-b6ad-3c7c3477f6d6", "comment": "Malware payload", "value": "eb999f406d4762bf6b7305520567e45eeedae78a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414590, "uuid": "eccf38ee-e01b-4901-a284-e100de9ff597", "comment": "Malware payload", "value": "618b875eb6010309585fb9eab2392cb518b5a93769b97f089047dea9bf80370f5faed49fb17d240f2e6bf7a59f270564", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414590, "uuid": "55f7a25c-cf26-414d-90f1-502238de9494", "value": "T14BE423DB2AD698D8D5B823B4122C98BDF5C8A72321AF398540FDC76DC371A73C70516A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414590, "uuid": "ac86bf62-5345-415a-a050-dffc2738703a", "value": "12288:VPoRXyGuEbKNUltGxxhNtU4ZU4JjfTQWSynD2wXHZ5OcrnyoEfTi0mTqjQy:doRwE2N+tYBJU4JHQQD2wXHZ58TPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414590, "uuid": "0d8ad536-4e09-43f3-b832-9ef521d69a50", "value": 706714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414590, "uuid": "4d73d969-c638-4942-a8ef-e2a8a21b4a9c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414590, "uuid": "58db6543-24bd-45bf-b0c3-4c1f9ab3054a", "value": "comprobante6739962.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cd7a8f-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691390448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390448, "uuid": "e13a046a-870b-4036-a73f-70c02374a13d", "comment": "Malware payload (Formbook)", "value": "0d7cc3719f4863d35909816a1366691c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390448, "uuid": "e050c65e-6c14-4cb1-b870-8f6d3558cca9", "comment": "Malware payload (Formbook)", "value": "0cc4308eaf906783b45db5c75d2bf7e5a0b74d9d531dcce595604c1f436d4fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390448, "uuid": "84378e23-b89a-4b27-8e12-635eb7da0ae0", "comment": "Malware payload (Formbook)", "value": "c0d3ca09c155fccd6db10a0b15a994dfb6998cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390448, "uuid": "ec0e3b07-35b0-45ec-b5e7-fce4a51f24b5", "comment": "Malware payload (Formbook)", "value": "44388eb09093f7725b597ec6b97dee94949a41e3cb124a64bffc3d71f3baa308b8835542d0d763bc1f0c1cc1bf1dad05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390448, "uuid": "3a8250a8-c14d-4401-84c4-96fbd1ccdff9", "value": "T1554412A0B7A9DC97D4A70332267E0E342EA6EE135875174B13107A4CFFB16A0DA0F795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390448, "uuid": "21c1ef65-c059-4f1c-9d6b-cc8285b5ee94", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390448, "uuid": "89020d8f-2b9d-432c-b62b-e5ab94972066", "value": "6144:jYa6CmDufniJh1VycZN55SBF0CTcKaRjYuui9:jYMmDAniJh1Vyc758dTcKaxtT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390448, "uuid": "0d162209-0d5d-4725-9389-efbcefcce0ff", "value": 274815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390448, "uuid": "34d4e5c8-3fe6-43e1-a2dc-669f8b113e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390448, "uuid": "9a2372d2-bd86-4bef-9b44-0661f0cdee07", "value": "Purchase Order-2130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9927e2-34c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691373006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373006, "uuid": "2fa555e6-a1b4-4f3d-b9a4-f096daf21539", "comment": "Malware payload (Mirai)", "value": "a23c5cdcb417eb3c061b7e72960fd624", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373006, "uuid": "b1f6e120-6d2c-44ac-9403-f300a6807893", "comment": "Malware payload (Mirai)", "value": "0d2adcd40c15e7565c247d09e554aacfc92e4a69d2617546061b6ef4aebdbe9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373006, "uuid": "269ca08e-7896-4fdf-a9f8-a27335f8c60d", "comment": "Malware payload (Mirai)", "value": "f3595b62b38b339ebc08c6486a37af898d688021", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373006, "uuid": "0873f474-5ec9-4798-a2d9-898893fb2831", "comment": "Malware payload (Mirai)", "value": "394bd6c9cecd382c1911f8ebd4f6b87ea61e6fcdb34f504b3951968f6e7b7c0d467231c8be2eeb0d24cf834b49d23a05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691373006, "uuid": "d9dd95f3-ce7b-47f4-809b-d3217c6e6370", "value": "T141330132811798F7C8A9947AE8584E83D89F13FAB065B375315CA1ECBD72B4736848C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691373006, "uuid": "715e2ab0-9caa-412d-9696-013ba347fb08", "value": "1536:IDedUGG6vy7836QIYDdlQguWsLWwKeo5ToC5:IDedUGGsy7cCYDdGRLa55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691373006, "uuid": "4cf69179-4f8b-4f5d-9655-9dc2481e6f83", "value": 51964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691373006, "uuid": "97b42dd4-4eb2-4f1b-827f-60e0ead94733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691373006, "uuid": "4282d4f5-263c-4772-9145-c802288b59d8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73746e31-3518-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691408962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408962, "uuid": "8105d41e-ef15-4ee5-bd7a-c5c8265ab353", "comment": "Malware payload", "value": "641a33d5e95c41f645924c9e071bade4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408962, "uuid": "15351af6-c5f1-4576-aeda-619528a1036f", "comment": "Malware payload", "value": "0d75f703f25c6bc527f8a969bea1dea350180b7863c0999e002b15aa592b95c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408962, "uuid": "28f97131-a92d-42e9-a5a6-762b6fbdafed", "comment": "Malware payload", "value": "c462394179caf1f1be7921c4b90ac56f97d329ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408962, "uuid": "6eafb402-d18e-4c6b-a5ea-6eaed083e792", "comment": "Malware payload", "value": "9e638d0e3d2bca958a1620c8624a8089ef7e2697b9db055ef03cb92b363d6e13f5f502406520ca9ae7bb5231932fd14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408962, "uuid": "8a51ed7c-803a-4101-acb3-aec57761318f", "value": "T16E945A0874E3D136E0E381F2866AE3164678BA6023B545C7AFD84D5D5FA84E0BF7721E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408962, "uuid": "1a2b1c55-277c-4032-a28c-eb3c0d3e9943", "value": "a937ee21afc8da8c636807fc65975a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408962, "uuid": "7d566024-a1bb-4638-be9c-0d9f21bc2064", "value": "12288:gSMHigZGDNHOccNOLaWDRWKdrSzVloKZ:WHigoFrcNAa8RWKd+zVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691408962, "uuid": "d0fd756f-3262-4324-8f6e-df1e795133c5", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691408962, "uuid": "d05e7d99-fc1b-45f0-af7f-add13f048c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408962, "uuid": "b83a36f5-e6c4-424f-90e2-85ba22d99a6e", "value": "0d75f703f25c6bc527f8a969bea1dea350180b7863c0999e002b15aa592b95c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6d33c4-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414724, "uuid": "0cb512e9-c423-4b61-a912-ebc08057530a", "comment": "Malware payload", "value": "d5530c1b047ae9487d93d40cacb3bc55", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414724, "uuid": "bac5e2af-4559-4ab8-8aa6-bc0dbd786b42", "comment": "Malware payload", "value": "0f0da1a657473454436ea00600aa138c3c461bd1f649513ed4042b930a5215d8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414724, "uuid": "a0d4c2a9-4909-4837-afec-12c13644aea6", "comment": "Malware payload", "value": "a8275d49ebea7cd46000dcfd17934dd73d31199f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414724, "uuid": "a2a29419-7aa0-4209-ab4c-77aade896520", "comment": "Malware payload", "value": "c210bcca3e901fadcfe6276595084d2a80a26d6fc8c381369253659d32c72b8f8bd481776f499f10326fde3f0c990a9e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414724, "uuid": "e47b0062-a27a-44f7-9472-6f016eab22df", "value": "T1E0E42384D9061C2ACFDC23BA5CCC2C4C9851B68D295CBB2FAA85D43DFA051F7635CB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414724, "uuid": "327a18c6-2eb6-4888-bafc-9247ffbb93a4", "value": "12288:ovnWchTH6+MT/YmihCH6omkGyuCcjeSQbO35wR/XwpI2kfEIceCWaN5PF:u5MTgFh19VWSQbO2RPwpI2kqeCWaN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414724, "uuid": "d055d53b-7a28-4938-a5dd-cca98e64ff8b", "value": 663328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414724, "uuid": "e2899c24-cd12-42a2-bb50-1e95a9941f2f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414724, "uuid": "9c716b1a-4ad0-4545-b327-b6e3ea24c713", "value": "RQSG6286-ORGT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70deaa8-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691414310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414310, "uuid": "8b98d7be-8635-4c86-86cf-366f4ad1623c", "comment": "Malware payload (AgentTesla)", "value": "d151483d0a8b057a4aaefd1b0c00f84f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414310, "uuid": "fdfe2d94-8f9f-447b-8ae8-da7b653c784b", "comment": "Malware payload (AgentTesla)", "value": "0fdf195ce4910a0c99721b6f2d9cae426b2850c2034d2e2ca817614068e66cda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414310, "uuid": "a139b428-31f3-4ece-8f25-4fc52e24bfda", "comment": "Malware payload (AgentTesla)", "value": "d76f01e2874958c1af6c27492be2256e4893e420", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414310, "uuid": "813e1e19-1ce1-4060-b6e8-9cdd208b731e", "comment": "Malware payload (AgentTesla)", "value": "912ee98e234b4c7f2fbb35221c2d0f17c79573a72dc8296e89c2aed1bfca296b6bdc0cb0437ed54f8ef0cde32a6690c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414310, "uuid": "6c4d64ee-2665-4317-8d2c-b2772972325a", "value": "T14535E003E900DBC3D41D83F87E530ED91F0A6F19E99569EB04627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414310, "uuid": "1180c322-4759-4b5e-a365-ecbb952898fa", "value": "24576:fRZyQw6VfZyQw6V4jKaWlEzp7aW9dlzZbtQA3Qp5EfIwsx:fbQ6VRY6V4jKjOzhdHt/3XfIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414310, "uuid": "1d65f4f4-6512-4d18-9ea0-66975337bdcd", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414310, "uuid": "9c7092d1-789d-42bf-812a-f3102f290dbb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414310, "uuid": "951baaba-5ecd-42df-b19e-e5c84c94d3ed", "value": "Transaction_Receipt.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe7affe-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691395367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395367, "uuid": "8efe2157-b22b-40d9-a977-5af36e4a9b3e", "comment": "Malware payload", "value": "26b5685493d76eadbf947a41a6f25ec2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395367, "uuid": "d7e50a81-1dd0-45e4-8eec-a5fdd1ea3577", "comment": "Malware payload", "value": "11fa33591b75a9c356e8cb59a9553fe8884f06996cd2fed97a859c53c44060d1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395367, "uuid": "6cc3ca4b-1a6c-43d5-8565-ed04b1f28a8c", "comment": "Malware payload", "value": "cfac8fce150848acfa025fc6e79dae1ceb186405", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395367, "uuid": "a964261f-1660-4d04-ae75-ba6dd9d39709", "comment": "Malware payload", "value": "a1a3d658076eb9ad874103f59f8e2f418bd40439dfda9b11269bbfb3ea3f95e5c77fb5f867b15fc428e608a7bcaab46e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395367, "uuid": "6e362609-6f84-47b5-af80-28511eda31fd", "value": "T1C7E4232E48774624CFE3A4739384655FC44639EF0A5F2B1BFC12A428DE76196329DC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395367, "uuid": "3c264720-11f9-4815-a104-31261411853d", "value": "12288:GH6qFx5wdA+/4Q9ebbN71prmB9+A87M5dxWwEYM6JsDq/ivMyy2hVL:wFx5wRQEO7jrmyF7MwwB2Dq/iLy2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395367, "uuid": "b192e7b2-5a7a-417c-950c-4b6885ce2cd8", "value": 682858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395367, "uuid": "de8c5406-e7be-4dc9-98cf-921b4f2d5640", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395367, "uuid": "c7651100-6d11-49d5-9846-82686d1db163", "value": "PO018G2023JW.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a29b33-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691414762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414762, "uuid": "9e2f2c85-9e75-4639-a9fc-8ecf18e84ee0", "comment": "Malware payload (SnakeKeylogger)", "value": "443e65dba3478a9d5c182821daedbb24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414762, "uuid": "d9a064ab-976d-4423-b72a-780f6587d1e2", "comment": "Malware payload (SnakeKeylogger)", "value": "122299dbd449798d5504153e36fff8916b5b9bf2895384d2105f67bd040a7eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414762, "uuid": "55b7bf0c-e23b-48e8-ba30-dedc32f5afa3", "comment": "Malware payload (SnakeKeylogger)", "value": "293ca9c32b1dffbe0b7942cd32060bc51f5dab85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414762, "uuid": "5d9c46f1-eee3-4b73-851a-8d42600c1f4b", "comment": "Malware payload (SnakeKeylogger)", "value": "a5197f8e82964f369d40dcb6efcf41fc26a8609ee19eb778ddf190d6fa48443d7760d9c761b82c8e89cd8177fdfa28cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414762, "uuid": "abc174d5-f1f2-4ce7-b589-87211d963155", "value": "T1D3B21A1C665E5123C69C1EBD94D7524223F1D66778C2FB8F8D90A05B28A33CD5C236EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414762, "uuid": "7f4b4140-69f6-47ec-a62f-d7d53935be2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414762, "uuid": "05e3eaef-6b6f-4631-9782-745df29b16a1", "value": "384:NxHFkRaejqyS7F6BCHZrEc9eNQ/ffLxhw2vWS2bRFAUjXhKWxwlJpq61Xabs2FGd:3YPwFjHZrXsGzxh1WNuKRZk72FGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414762, "uuid": "8b1ad6fd-560a-42f1-b07f-1679a55445f7", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414762, "uuid": "ecc44ce3-fec7-42c0-a037-93cdd449e200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414762, "uuid": "36ab81ac-6637-4091-84a7-ad67eb842877", "value": "122299dbd449798d5504153e36fff8916b5b9bf2895384d2105f67bd040a7eef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d029f62d-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691400528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400528, "uuid": "c2c7d3a8-8c5d-439f-9302-6d46f4ba8613", "comment": "Malware payload (AgentTesla)", "value": "2c6c2c3fbdd819ee45b543d6632f842f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400528, "uuid": "f76425ad-8fc7-4a68-827b-13117d19d56a", "comment": "Malware payload (AgentTesla)", "value": "13d8605745b104326328cc687fff7b529449c6ea732edc7e6f42d2c33af7858b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400528, "uuid": "51fe0ed4-f856-4d20-8fe7-fdc39ba9aceb", "comment": "Malware payload (AgentTesla)", "value": "2d457867c3a63c535dd22df1004d0e9d219b6960", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400528, "uuid": "448c5869-7374-4fe8-a1ca-08a57e8aff93", "comment": "Malware payload (AgentTesla)", "value": "9576379b076a2eb5105d9d2132b63a73f17ab025b0293a5940587ca181bbdfc10d72e16cae45805ab07d6d8c5e19fdfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400528, "uuid": "0c9ec4e1-c3c3-4720-b7fa-cae0011aeccb", "value": "T13F83136D934F01A9CF925237972A4E4842FDBB3EB38551B134AC437933AEC2D51262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400528, "uuid": "9ce87eaa-96f9-494c-8aae-73f600cd0468", "value": "768:awAbZSibMX9gRWjbGkBeKvosrxIiknaIqzipg5yB0vPxR0H1RQwIO66kp:awAlRWGkBefsmi4a7A0vPxRq8wIxFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400528, "uuid": "b6720e61-0898-46ff-8fbb-a7aea0b6ab61", "value": 81341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400528, "uuid": "86a0745f-ecab-450c-a811-321c35a58ec7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400528, "uuid": "f215d77f-69f1-467c-b69e-9e6c26bf2593", "value": "logszx.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad8156e-3564-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691441724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691441724, "uuid": "6cef23f3-b82a-4b18-9d20-6d32a028eb20", "comment": "Malware payload", "value": "99d263bc419912ba142bc7f52829f1a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691441724, "uuid": "032e56e5-39b4-4c09-86da-244f1dec9f89", "comment": "Malware payload", "value": "13e5bffd1836902ef0ce11ecf85d800bfc1956e13cd86c8f01567bca207f9bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691441724, "uuid": "641a80cb-4e2a-47a3-942c-38e8e2d5eb4e", "comment": "Malware payload", "value": "3bf885b602ebd2cab9bbd5c32540d0afddf8d3fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691441724, "uuid": "1a5cd7d7-9cb1-433f-9295-7170b1cd4147", "comment": "Malware payload", "value": "f12f0f198ec501b76d0bc2fff4f9bb8f6661df2bc7e7ab4d2b4aa4892f68ee9eaba6c8f2d94836897e174d99b0545ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691441724, "uuid": "7bca0993-8b2e-4683-95b5-da5207741940", "value": "T17915AE47AF9ADF83C22796366CE3C39433BA9C525F9683176289223D3D776841F06391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691441724, "uuid": "75162646-5f3a-4e74-a6d5-aae27acd3d8b", "value": "96800ba95a576a34142583807c18b7f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691441724, "uuid": "9bdb56a5-3b42-415b-961b-b0e22753595b", "value": "12288:K/rqXAutIBH9QrFSvVlmDp/pAuyoH6hLeHNdW2VuxzFHJ5RBDLUsWrBUFjjStDBK:WPumgr4v3GKC6q42czFXULraRjEwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691441724, "uuid": "edc1c104-a99e-4092-b26c-6ae3d1a3bb8e", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691441724, "uuid": "efba248c-a575-4361-a82f-b9cd62b27a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691441724, "uuid": "3f8fc970-582f-4e46-8ee9-ad183119ac49", "value": "13E5BFFD1836902EF0CE11ECF85D800BFC1956E13CD86C8F01567BCA207F9BBF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca62da0-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414588, "uuid": "6ccedfed-b8f8-4aae-8de4-ced11bd28a99", "comment": "Malware payload", "value": "825dc7e5087201e51a8070cbb42e6bd5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414588, "uuid": "97a9e0d0-290f-4051-8972-cb9898bc75ec", "comment": "Malware payload", "value": "144fb1f6ffb03a56e41d07b2a06bc3b3b65562c02cc3f9b15e137e7de1ada433", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414588, "uuid": "ecf93513-a87c-4785-9fae-d9414ff88ec4", "comment": "Malware payload", "value": "a147d086ebc4b4be9b39e9a90efb7e887f39bd68", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414588, "uuid": "ca1f866d-f243-4f2b-9178-f8052ba362bf", "comment": "Malware payload", "value": "bc31d40a65844d0a60741d699f36333b05d2626eda61c24f01ae517e580ea7f9d4c66fe0a5521f120c976c02458e58f7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414588, "uuid": "c1c3a604-96f7-412e-8cda-a2f1fe4584bd", "value": "T1F5E4234B58871488910B582FB2433CC4FA7B6CD99C8DB56B9DDAF24533A93B402DFD4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414588, "uuid": "b2db9348-abda-49ea-87cf-e4e0c1d1a5dc", "value": "12288:T5vApaZxxZR4egWjQOthaA8AgwWEveYs42ddOVGGBFLWe6sGZoSD6+s5Uz38F0+f:YaxH4JWjPv8EveY12GGfemZoSW+sSz3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414588, "uuid": "32e74dc0-d076-41f3-a1d7-9a0900e190fa", "value": 702942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414588, "uuid": "17811e2b-d536-4460-8b5d-b235f779acb7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414588, "uuid": "5afef9c0-b3dc-45b8-a748-5762d29daa22", "value": "NEW ORDER 564721.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e320095d-3568-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691443509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691443509, "uuid": "bce0afba-62b4-4e32-8eee-ac7ef95877cd", "comment": "Malware payload (AgentTesla)", "value": "b45fe409caf220e84ad1acc3f5cd7f44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691443509, "uuid": "eeb2aa93-2d44-4122-b01b-0a0e12e98b8d", "comment": "Malware payload (AgentTesla)", "value": "1496cc2741444b58ba3815b091ca257bbd9f17e85ba4d00fc26d725b6b8be422", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691443509, "uuid": "7eb1e1d8-12db-4764-a2dc-0dd4d99a1fe9", "comment": "Malware payload (AgentTesla)", "value": "0757070d5033fd8653915293f811d40964453933", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691443509, "uuid": "62dd889a-3316-4a1a-b2dc-8eb64fca0505", "comment": "Malware payload (AgentTesla)", "value": "aeda0c7539bfc7c85669b5cc281107670065d2eb2b6cfb20a7b30f7b45b376e26398638c60cac2871af7e34d9d919bc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691443509, "uuid": "75ec7df3-4c70-4cc4-a470-c9587427c9f1", "value": "T1E3E4221666EC8F85E3F607F4143881680FF2610609A6EA1C5FD6B5CF5DA7B02CA21F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691443509, "uuid": "c02fb6ce-4cf0-4b99-9ff4-df09333f3418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691443509, "uuid": "ed33fb04-159a-4553-aa5d-3dcc00341983", "value": "12288:++niF99UJ3mFckqDmCDvavtsasT7XdJ3qP6I6o32R+CPwZhhUjdcyw/I:jniVUJWuvqwye1T7v3eb6o32RoZIdug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691443509, "uuid": "081694fd-396a-4005-b523-e65ed969fddc", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691443509, "uuid": "72bf4341-ca1b-4d88-be2e-10c5d20e5712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691443509, "uuid": "21a41e20-9cf8-4166-b6cb-2736d9c48527", "value": "z46CVLicHSOlivettiRenzo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba5d1d6-3515-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1691407688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407688, "uuid": "6a67d2f2-5a52-4d8d-9830-35b4f5f71b38", "comment": "Malware payload (CustomerLoader)", "value": "99ca96aad19f9b58bfaa026e8b3e40da", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407688, "uuid": "4e080745-c44d-4c55-86aa-8556aeb44954", "comment": "Malware payload (CustomerLoader)", "value": "159be70701e7fe1d7d41ae092f1892f87d0cc615c829b16aa78a333e6a7aa923", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407688, "uuid": "b74f84e6-fedb-41b0-9aa9-fc13c6ed587a", "comment": "Malware payload (CustomerLoader)", "value": "11bfab7bc400bbeaec6a46eacbcdbcd490dd4640", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407688, "uuid": "83711892-f1e1-4b1c-be88-5a9d8b217d09", "comment": "Malware payload (CustomerLoader)", "value": "98f9259fdd733e71cf8b5298fab6d5024964feafb8f113d7ae373b438c78a75a1ad1f5c10f81fae1d051900ee57b4bb0", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691407688, "uuid": "eecc01cd-7b79-4cf4-9a18-efc0a73f13ce", "value": "T14F221A088BFC111BE59B97BCDDB302821275AA7B3543EF2B9A9C91C90C613D06F91376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691407688, "uuid": "a6724af2-e8d2-437e-93fd-0f74680fe6a2", "value": "192:xSHXwiZU4+PVsBdlCnnV87Mf7Fhqg9QblGr3bzssFssq:MHVU4kVs3UnoezTyl+vssFssq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691407688, "uuid": "251e364f-c20c-41c6-949d-2f175b87ab0d", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691407688, "uuid": "2f9cd9ed-f893-4bde-9b07-76e5a6cb6cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691407688, "uuid": "cd82a6e5-ec5e-464d-88dd-d9eb8edcc2d0", "value": "159be70701e7fe1d7d41ae092f1892f87d0cc615c829b16aa78a333e6a7aa923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6705fd52-34fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Sodinokibi)", "timestamp": 1691396486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396486, "uuid": "e9077dae-341b-40be-bcd2-68511722c3cd", "comment": "Malware payload (Sodinokibi)", "value": "b572a0486274ee9c0ba816c1b91b87c7", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396486, "uuid": "5706e9e2-1676-4443-912d-8cad1e124d98", "comment": "Malware payload (Sodinokibi)", "value": "15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396486, "uuid": "d93f2a47-d22d-4828-a18b-6176a8478f8a", "comment": "Malware payload (Sodinokibi)", "value": "43a904323a8583203b307c622c71c8ca706c2462", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396486, "uuid": "c75086e2-823b-4d39-843e-6cbb66581db1", "comment": "Malware payload (Sodinokibi)", "value": "30e1bfd27a7b78c98e19ee16a1f5919ed472e832fbe76b913c2dbfeefdc9a6ec7a30425e5710fbe0e1fea3e67c58ca88", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396486, "uuid": "6d4be21b-03cb-4b17-9f50-e26c98c762b6", "value": "T139F3C0266D9001B7C9A742F1962B3FE7E6FEF939131515CB9350C4842F324D2BA2B627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396486, "uuid": "eda64699-9dd4-403d-b4f0-253841be72ea", "value": "3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691396486, "uuid": "7748a086-42bd-44b3-a7e2-2b4a78c1a5d2", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691396486, "uuid": "f6721957-9c43-4cf9-a854-826f52851396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396486, "uuid": "0ac61633-fd69-48fd-896b-cb7d576d493d", "value": "2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716e4caa-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691394785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394785, "uuid": "ddcc00de-cdba-4852-92d1-901a8d0af1fc", "comment": "Malware payload (Formbook)", "value": "4d054b190e5ceacdf9b0e99e0216a625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394785, "uuid": "776f4758-3c7e-45e7-93bf-7f3e19d96fd8", "comment": "Malware payload (Formbook)", "value": "161a446d57ffc13178f1b7d0ea96d7b1d4dcb1d86117b139ec84628f45051eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394785, "uuid": "2352e2b1-8b5e-4067-98ca-8038fdd08a79", "comment": "Malware payload (Formbook)", "value": "e30f43720ed7daa3074cb867aa4abf5e34866be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394785, "uuid": "655ebe9e-6a36-43e8-afec-831bc7d994bb", "comment": "Malware payload (Formbook)", "value": "be6fad738e8a56ac776da10a7669bca9a8f8eed255a28eb92b43e1610d257956d51024779426c538ddcbd4b6f0027e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394785, "uuid": "dba97375-c6ab-4599-a9d7-5fbc61650a8a", "value": "T18EA3D6CBB68AC5FAC1549F3AC19B5C500F61FB82B773C63AB58D23050AC37E9984564B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394785, "uuid": "8078d178-60ac-4bd7-99ea-093e752b9be8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394785, "uuid": "52b53cae-465a-412d-9d20-719306f5d719", "value": "1536:HRjVuLjuOdhClVaGMYsKGdll9IDuwjtPrBDZEMAINbD/9ELWCZf1DS2gHdNIdf3H:iSMYsRll9HwRBDZE4NCZf1DS2gHLyeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394785, "uuid": "765db740-70bb-4517-b5f1-8c984e4d2eeb", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394785, "uuid": "45a21d99-56c0-4e3e-9389-bc4998662592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394785, "uuid": "aa47603a-a760-4f9d-85d6-09ab7ba0e732", "value": "Ferlam Technologies Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603b37bb-3507-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691401629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401629, "uuid": "72507d10-85a0-49d6-be34-643a59fcb55c", "comment": "Malware payload (DarkCloud)", "value": "a748ee2707f3e359ad74455545cc6d93", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401629, "uuid": "a95c0397-5649-4749-9581-c4915d954e65", "comment": "Malware payload (DarkCloud)", "value": "16a79ecc949598a257a379cafec6c7197eee0ae0af367c724cbf940b86250851", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401629, "uuid": "b8f4b4d6-1b0b-405a-9f87-89c1d7b4fb1c", "comment": "Malware payload (DarkCloud)", "value": "0332fc7cdbb07d58fff7e2f7e3f8bf8f6f431ed3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401629, "uuid": "53057655-7a93-4371-902c-ca4410c7bbc1", "comment": "Malware payload (DarkCloud)", "value": "1cde6430370e897090e057cc9e3282ad950052a5214b942c02d9ec0288dd439396f56b2e6678742d5f84e43c14a0e471", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401629, "uuid": "1344886b-c727-46c3-a6a7-b0f68c1bd68f", "value": "T147844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401629, "uuid": "202b40c3-856a-4a7b-bcae-b2a5467c5bd9", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401629, "uuid": "df8ed065-3bac-4926-998c-3d14b4792f92", "value": "6144:1hys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:1hys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691401629, "uuid": "5c78d948-d25c-4c5b-a832-38e689051181", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691401629, "uuid": "98e9883e-f01f-48c0-afe0-7d7a887a1f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401629, "uuid": "0601d18f-c5c6-4d5c-8cdc-be522e011a7e", "value": "16a79ecc949598a257a379cafec6c7197eee0ae0af367c724cbf940b86250851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722afadb-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691394787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394787, "uuid": "2ba6ed81-3cc8-4da7-99bc-f01d37bb9905", "comment": "Malware payload", "value": "1eaac0ec2e0b102425dcf5cd3d2cd68d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394787, "uuid": "bdd135bf-96a4-46a7-a760-c09896b84a99", "comment": "Malware payload", "value": "17191b079c7be3dfbe2a297d499e3742c875704ba53e5ef73098eb9de8118ff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394787, "uuid": "c40f9c10-eccd-4fc4-b56d-e1ff26bc2353", "comment": "Malware payload", "value": "242693a0f7124341f1d722cc0eb0952c8d41d6f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394787, "uuid": "e1e4e7e9-6685-4161-8a9a-310694c46de1", "comment": "Malware payload", "value": "aaecdb7c0cbdc133b67ed9fe28867c553d3ae002e6f72cd20c2979ff9dae1b5408a84cc4e95e50c4ab8160f11df3cbd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394787, "uuid": "6fb50597-caaa-43cf-88fe-e473f7bf9a01", "value": "T19FE40228726D8923F67D5BF594F6D55803B2644A2D2AF1ECACC138CF21F9F484902B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394787, "uuid": "dd8606ab-38df-4c9f-828f-83027224e023", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394787, "uuid": "e4ed9dd2-18fc-4770-b02f-44ad7ef4ef30", "value": "12288:InjOMxnVhS1riB0XKzeM1/KW6YlJXZeCs8nhR+v7NWdaPaE:IjOMxVhSBzKSIKWUC9mv7GAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394787, "uuid": "2e7c1355-c841-47ed-b7d2-cd4457e43e9c", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394787, "uuid": "274d041e-197a-47d4-bcfb-1cccfccd0ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394787, "uuid": "60ce7961-4831-4f21-95b8-58f9d4e55003", "value": "GE-027 deposit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaae0f4-34bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691370006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370006, "uuid": "1faf5bb1-1a9a-4c61-a166-cd40adc47279", "comment": "Malware payload (Mirai)", "value": "585063020116230f1164d8022fcd69bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370006, "uuid": "7648d868-8a50-43e3-a3c0-c526926cb814", "comment": "Malware payload (Mirai)", "value": "17a29e15adc5a554c22b6223543459b45c0fecf90ecfc66c76f6cc1099b732ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370006, "uuid": "52b5351e-6473-43d7-8592-bf98230a1963", "comment": "Malware payload (Mirai)", "value": "2884f5dccceeb75a4a7991e41a753220d6cdd6b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370006, "uuid": "bbaa4b62-6119-4792-b418-ca1f61539d16", "comment": "Malware payload (Mirai)", "value": "a9161d1ea03d250661eb285b7fc380ec88b504d7df49779d7f550f80520bd3d547533ee03356775588dc0f138318d3b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370006, "uuid": "d532babf-98e5-4a06-911f-7b07f7b983c2", "value": "T1AEC2F0BFB6AA6A17FA1D633DF025811B03E4F41C97AE2B9767004432DA5E41D7532CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370006, "uuid": "616556af-3076-44e6-ac14-58b9375de480", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHUN/BxZ:RMwxdyoEUnDz+Y8tqHWXm0tBvQf+0NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691370006, "uuid": "5cbe3d0f-d7d2-4855-a335-d370709b3e07", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691370006, "uuid": "94da75a3-7a35-401b-a02c-7ad1b5eb5c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370006, "uuid": "a8d86f4b-be48-4b52-a919-43ff1fb04db5", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc074b7-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691414212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414212, "uuid": "155735d5-96a1-4676-858d-038e80a40178", "comment": "Malware payload (SnakeKeylogger)", "value": "4c04bbc78a794f659d4dd83e95c3d522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414212, "uuid": "babd3f65-b578-45a4-abf0-fe28f44644fc", "comment": "Malware payload (SnakeKeylogger)", "value": "17aef7f33ee1725a500067cf27953fbaaf7ae489c2cf974a0d5a676e454750eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414212, "uuid": "d17165f8-4e18-4bc7-9a69-3e42d5c3e103", "comment": "Malware payload (SnakeKeylogger)", "value": "3368899d115079599f67da061d2bb980913ce042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414212, "uuid": "d9efef5c-6318-4485-8544-e07449779ffa", "comment": "Malware payload (SnakeKeylogger)", "value": "4fa0c614ca55d119e796e62ff89bc9b1e30cdd10b153d26e4971653af15ef877f786ec61b25b2add0532f830186fbe89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414212, "uuid": "9d8098a2-25dc-4332-b9ad-59762e861a9c", "value": "T1F0E4D503BA8789F6DE485777C59B100033E9D99137ABDB1E798E23A609437BAEC41707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414212, "uuid": "bc2d34a5-adbd-4241-8ce4-4029125ff6aa", "value": "12288:rg3dNu3HCZv9Z228k9mp3ZFm2CrFpYqjrUVRajl6l2GRwLfQ9g:rg3dNuMv9Z22f9mpu2YzjrARajl6Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414212, "uuid": "9f339eab-a459-4bcd-b213-c0271602cf1c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414212, "uuid": "63ad9e8b-cb87-4bd4-8c9b-5caa74513e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414212, "uuid": "fabfda0e-c94f-4257-9cea-f0823ab26e12", "value": "Tudehluxjc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc00c96-34d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691378915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378915, "uuid": "966acb57-7d88-40e9-a989-4bb479a4cacb", "comment": "Malware payload", "value": "8fc164ff222a4bc0d5b8db2b735cffbb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378915, "uuid": "72b63fc1-a060-4ab9-9c7d-3b4d5c3abaa7", "comment": "Malware payload", "value": "18d8a6f7d449f2c0d446e658ce05bb4a543dee9aaef1de646a1f61b409113785", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378915, "uuid": "0dded4d1-d4eb-4a00-add8-33bbc6c96f25", "comment": "Malware payload", "value": "59eb826cace114af914d73f808ef4571794b599b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378915, "uuid": "d4135dc7-a5e6-4978-bf9e-dedc704d72f3", "comment": "Malware payload", "value": "09c5e5bb465e21ad0aeff750c6341d7e76a4ca0a6c99757386d2b16bfdeede63a826ced170aaa875999de1e517215694", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378915, "uuid": "27f892de-8384-4edc-871e-fd7b5d5dac41", "value": "T116428E728B87A426DF9D4EB51C539C04BB794093212B113493AC46DD9FA8B93E072366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378915, "uuid": "b57dfe3a-9af4-48a0-ae74-a995f61ab55e", "value": "ade319425a5a03430e1ad57861abc6f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378915, "uuid": "6a8f673a-b682-46be-962b-877c53ed1434", "value": "192:qN6mVCPu3Xr8ZoMcWTBjYYJg3KEWmZvn3dv2GJd+sZm+/FduUFdBMPT2mOSelVly:qE1k8ZJcWT3J6KErRzyE+ySehy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378915, "uuid": "17cde0dd-352c-4e91-be5f-d11fc3d6caf3", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378915, "uuid": "4ac2833d-ffc2-415e-a263-73ae38a84a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378915, "uuid": "f7515eba-84f0-4bac-aa7e-95c953279eed", "value": "SecuriteInfo.com.Win32.InjectorX-gen.17957.15181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5c31db-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691414210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414210, "uuid": "0a454fb0-ad71-4a69-a91b-09d634252181", "comment": "Malware payload (SnakeKeylogger)", "value": "c117d5b5834bd2624b405d473c86a963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414210, "uuid": "0a67a8e5-cba2-4d2f-ad0c-d693453caa8c", "comment": "Malware payload (SnakeKeylogger)", "value": "19663c25e9873f288152b6a990f0e1d315b7d076d4c62d1d184961d7232f94e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414210, "uuid": "e8a498ba-75d4-4197-b5b3-193e6289582c", "comment": "Malware payload (SnakeKeylogger)", "value": "927d62af4996de5729869bc50b571e2a8cc5fff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414210, "uuid": "cefe5ee8-fe1b-4642-8694-44e43b39a27a", "comment": "Malware payload (SnakeKeylogger)", "value": "02b66ed7c53dac44c016c537a33cfbfe403dc7f4fc8b5eef61fe5e2e7a3a0401e070462d7783dd360170412383dec317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414210, "uuid": "4d9a0a63-5a2e-4bc9-93ba-44d6b2e04d5b", "value": "T1F8E4E703BA4789F3D289577AC69B100003AFD681F79BD71E798EA39619437BEED01607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414210, "uuid": "0a66743c-0f0d-4396-a0db-53ef7f330903", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414210, "uuid": "0010fed9-2abb-4752-a17e-436822ad27a2", "value": "12288:8ep7sHEkolwsdvh82e1suhPTg40xjl6l2GRwLfQ9c:aZovhdDA8jxjl6RnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414210, "uuid": "cfcb99e9-0964-40d7-a96d-f70e0dde6f9f", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414210, "uuid": "b6025ec8-fd69-4589-92d4-3a962f2dd091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414210, "uuid": "051deb50-8a2f-4f2c-b45e-584aa421c5f9", "value": "854F1E97-5BDD-4A87-A566-33B9012D08E2 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab15719-3537-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691422101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422101, "uuid": "34551c6c-ab31-43fa-a899-8f04d255aed7", "comment": "Malware payload (SnakeKeylogger)", "value": "bf1cda1aaac943f349a69059961b575f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422101, "uuid": "73ed4796-42fe-4a7f-9d51-04d13ac3c425", "comment": "Malware payload (SnakeKeylogger)", "value": "19e38c5c8514abc327086dbb5f27fea38c07b91576c827306f4c50cb196af45c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422101, "uuid": "4c154c93-39c8-4226-a8b1-a073200b3f9e", "comment": "Malware payload (SnakeKeylogger)", "value": "f36579b6ff801a537035e8970f8615a22c0401d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422101, "uuid": "9afb33ad-0889-4032-b5cf-88b97b074489", "comment": "Malware payload (SnakeKeylogger)", "value": "084f5c4b47fbd706b42a98d4d3baa80b0a816de563dc341a6f84beebadc6f1b1399beebf64a744e74d835473eac728f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422101, "uuid": "7c2d6bd6-4a21-45d5-bd72-0b6ce07f5669", "value": "T11A1523007478931EEFAC5BF72829A67A03B4395F8D60FA5C9EA454E93023F4D1663D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422101, "uuid": "c1579f21-6684-43b9-80f5-bdec520da682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422101, "uuid": "55b8e405-6bf6-4651-b25c-7d4fb0252c72", "value": "12288:H3saC/RXBwwUXWuYuynn+ZPwmNSV39cvp003arGArlhx1kwUMxe1HXBTGYwo:Xspx8WMs+ZPh839WeJJH1kwIHRTGYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691422101, "uuid": "70542e3d-bed0-4b22-adf4-3d1f846c696e", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691422101, "uuid": "50e6b52c-43a3-434c-bbfa-78926bad0776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422101, "uuid": "2568556b-4adc-4be1-9517-d0a1006f443c", "value": "MT TBN - Calling for Bitumen Discharge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c71e3b-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394794, "uuid": "1d9133a2-895d-4ce9-9e71-b7d5d77c8866", "comment": "Malware payload (AgentTesla)", "value": "578c045cbefb674fcc8aac94dd0a28f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394794, "uuid": "1376e3be-fb12-448f-8a6c-3fe02d3fbc78", "comment": "Malware payload (AgentTesla)", "value": "1aeeee8fd29b50d58a53c9e0235b9d9b888781435ffec98089b4159443cd1a1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394794, "uuid": "f2d77d88-57c0-46f5-b684-37bf35ca081c", "comment": "Malware payload (AgentTesla)", "value": "fde753d2f09ba890a4aba578f1304f94f692c5d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394794, "uuid": "e576b52c-3c5a-444f-b017-59b2610a49aa", "comment": "Malware payload (AgentTesla)", "value": "2c69a0d35db7ebf8968d90a2fa9c49b0b2db21202c6ca9e54485c2c48870448f33b9dc62cb4a79a97d3dd8a61d2a8391", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394794, "uuid": "c74c61f7-a539-4d44-9d77-caeef911893c", "value": "T142D423B07B7D9774CE2E07390281181893B11E49BDD9FA7E5FC060892F65A42BD92F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394794, "uuid": "2da32f80-3788-4434-8bc2-b258496f4637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394794, "uuid": "eb8b8f2a-952f-4d55-9524-e75ef667d245", "value": "12288:+qxHdhSKEGepyb6lSBEI371MaZGM4QkJUZVtFt9h5vbR48yxbRTL4Af4fuw:/BS43b6lwh3C6nzrt9h5vbR4DllQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394794, "uuid": "9c6199f2-5869-487d-aed2-9174ab162401", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394794, "uuid": "5425aced-2eb6-4694-98ca-14d1093f9511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394794, "uuid": "58945057-f555-4d21-9e32-40c28d43fc77", "value": "PROFORMA INVOICE 0668 REVISED.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc00b80e-3508-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691402212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402212, "uuid": "961a91a1-fba3-4e42-ad4d-5935c7de51c5", "comment": "Malware payload (Formbook)", "value": "e8fdbc04d423a11f704ea0cc88616252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402212, "uuid": "f9f8adb8-2cd0-4a2d-a83d-167d01326c0a", "comment": "Malware payload (Formbook)", "value": "1c7305a0f09e826cf8296f2378894da3c1f30bb25daeb64f60365f08c1e8cd37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402212, "uuid": "d0973aa2-bb93-4b44-8276-a94f488b0ba2", "comment": "Malware payload (Formbook)", "value": "4a7c4304084cc9dd4e7cf97a76440b25543ebddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402212, "uuid": "573e3f61-8a94-4a47-8d15-4bfe2d4746ec", "comment": "Malware payload (Formbook)", "value": "55d7221815104688024ba8275a208574f2142d4f7ceaa041d7c147496be6b85976c0d7c1491f5f0ec6527d6327f5e2a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402212, "uuid": "061f8b4f-b696-4fc3-b90e-bf77d2c9f26e", "value": "T1502412F69151376EE135D2BA4D4F69F101F78E3929440633A103AA07C632A5E27F27B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402212, "uuid": "a7fc523c-9918-46e2-a64c-f5aa131e9429", "value": "6144:hDhaaVdKp93+vh4oYN3QU81483d6jDYlr/s2PLNr3J:hjVM9OvHYCtd6Al7s2PLN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691402212, "uuid": "32c01f2d-6dba-4259-bfd6-3db7898b22f1", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691402212, "uuid": "25f21a52-a539-4bfa-8750-809fb8357568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402212, "uuid": "092f9704-6642-4b5c-a602-bb3b30390e56", "value": "1c7305a0f09e826cf8296f2378894da3c1f30bb25daeb64f60365f08c1e8cd37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa440fe4-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392733, "uuid": "f2dc5dc0-b48c-47fa-b912-96e959f65e91", "comment": "Malware payload (Mirai)", "value": "d2fe43cc32be8490e152a1ace255abb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392733, "uuid": "cc4a6a51-3118-4568-b7d9-ebb2cfd82c4e", "comment": "Malware payload (Mirai)", "value": "1dbf148b0b94f9bb64275e7c80f3bbc12aae88689e2ba2630f3725f6303ffd23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392733, "uuid": "d575d7c9-c11f-4174-84d7-b38fcf165a59", "comment": "Malware payload (Mirai)", "value": "54ea38089d10dd065e14dff6d5591ec98dc8acbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392733, "uuid": "78093d50-2ef6-422c-b7bb-23e5602969c5", "comment": "Malware payload (Mirai)", "value": "6beb0726a765e4a104e2227bba52adde98c1d2d23d2b447e95b0bcbd610d622afa9152538b75b7841eaf5f33f2db865b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392733, "uuid": "5aab1d25-06d5-4fd4-bcdd-6b6e221dc333", "value": "T1B843B40A2E258FEDF76D873447B74E36A749338622D1C684E15CE9011F7028EA45FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392733, "uuid": "604253ab-4ac2-41c1-950d-2d9baeecd50e", "value": "1536:FSCSSS9+y7M0zk8NzMh82bZ7BtEBZVjICUgBECH:FttlYzk8NzMCUg2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392733, "uuid": "66e14a2b-1bb3-40c3-ae81-99ec098db201", "value": 55816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392733, "uuid": "53506cd2-64ea-4386-837d-e39e7f2d4646", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392733, "uuid": "335c1429-aa2f-4a98-8f9e-64173f1b9645", "value": "d2fe43cc32be8490e152a1ace255abb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d446effc-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691395381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395381, "uuid": "2dd62689-f6d0-475b-833c-65e75d541c59", "comment": "Malware payload (Mirai)", "value": "e59bf80683b26162704c83198e7bfa5e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395381, "uuid": "c59af37d-0deb-493a-a660-f00b1dc42ade", "comment": "Malware payload (Mirai)", "value": "1de9c70e46b17a96ee15e88e52da260de4f2d70e167c5172c29416d16f907482", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395381, "uuid": "3d49ef88-b903-450f-a991-c4c7ec43ec31", "comment": "Malware payload (Mirai)", "value": "b4ed7742ec06ebaeff36dc7984e8fb9f05e29c21", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395381, "uuid": "2469c92e-83b8-49cf-a499-36b14da2f924", "comment": "Malware payload (Mirai)", "value": "3cbd0b26e40e93c6ce74530bca78c3aa051c54db87ea3d99c1d32a0fb93509b55a36e105751971ce30d30996b69af2ad", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395381, "uuid": "d637f5e5-d557-4736-9ce7-200db866d39d", "value": "T1DFD2D0A954F7F1BCD0AAA6B9043D4B85ECB67216C2151BB708E83466DE430D90E30DF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395381, "uuid": "49f3f16c-fc85-4e6e-bd27-8171e1901ca7", "value": "768:TYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBowWHIe8Sx0sD:TYJdJZiy1aBnQfTqBoBHftD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395381, "uuid": "8ba00724-7db1-416b-8ebe-4ad562adcc03", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395381, "uuid": "a03ee899-015e-4cf3-993d-2d1243e02e9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395381, "uuid": "db14df93-dab1-45ea-a902-d27921b73abf", "value": "e59bf80683b26162704c83198e7bfa5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5990c5-3501-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691399095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399095, "uuid": "b666b3bf-13d7-450a-be00-bef4adc7ca4d", "comment": "Malware payload (RedLineStealer)", "value": "54631210ad8202513b794956c59e67a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399095, "uuid": "b2c84a93-0ada-419e-be5b-f8afc67d5938", "comment": "Malware payload (RedLineStealer)", "value": "1decacd4ba1021711f1a1ff1d14a2453965e211bee8e50533c4d6a2997ace6d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399095, "uuid": "2c9d4e06-7829-492c-a6fb-a4c72b4b9b26", "comment": "Malware payload (RedLineStealer)", "value": "dccb8282ba756c270ef7d1f0f2a034f164ec123b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399095, "uuid": "fe82aa72-b35b-445d-9197-cb3bccba5f1e", "comment": "Malware payload (RedLineStealer)", "value": "caa8c6a94a5f72bd857ba3df065e3bbae14958a2d8ae778edeccbc32d69391a78d494f1455e7821a7f4d924d65f8fcf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399095, "uuid": "80a87c84-58b7-44ed-ad12-1f23764a5c6b", "value": "T1A6E58D7038C08172DDE220B942DCB62505AF94A0FB6646D71ACD97FED634AD1EB32787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399095, "uuid": "c9a5f86b-c57d-4873-83f1-2c7d2f820cfe", "value": "bc1813b6b941bb3c0b066ce291c237d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399095, "uuid": "9c39ebfe-a2e2-452b-8ce8-d21bcca01c6f", "value": "12288:KjwLxC80uONQttjvbLu0jiwhKF/De22pudOLVedf6ImE5umQnf4JDic0PcYyU:ZxC8yQttjvbS0lhKtEVedf66oPPR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691399095, "uuid": "be4b78ed-4a29-4920-a676-cdcab2b3809c", "value": 3077120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691399095, "uuid": "2f8720eb-0517-4d31-af16-e4b00cb3d48f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399095, "uuid": "1db707be-3e75-4318-8a99-eab9f81f4fde", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.23285.15327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d9034e-34ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Nitol)", "timestamp": 1691389149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691389149, "uuid": "422af952-4895-4392-b39b-3a1a6a553e21", "comment": "Malware payload (Nitol)", "value": "e0e75c7b54625d7ae2054d0f5d9b08c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691389149, "uuid": "8e75d309-ca2e-4192-b1b6-32562836a274", "comment": "Malware payload (Nitol)", "value": "1e3c8d40ac25f58439cd1eeb3e69066bfb7f7554d79b125b4c2213152496eeb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691389149, "uuid": "fca15931-13ec-41ef-b5a8-d72babdd74f6", "comment": "Malware payload (Nitol)", "value": "ca684c30e3df6cbff5b25b066a57afebf20a58f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691389149, "uuid": "b64a5c73-ab23-4846-abe6-4e4d379a07e8", "comment": "Malware payload (Nitol)", "value": "1d26fbeb5d2c24a4bef1ea11452e49a7648f9f08e3b87f83d29ebd5d977b85c714f8a71d396d72eb21e331fddb1694fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691389149, "uuid": "dfcde788-d748-4a91-b763-d5aa3702ef05", "value": "T11C66334BF792D0B1E85A04B44831CA724EB5AE7197BBC4E75FE1791A8D303E0E772246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691389149, "uuid": "98c9c23d-0e40-479c-ad9e-dca869441a6c", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691389149, "uuid": "b217a72d-0df4-4f74-8f5e-9ea180466804", "value": "196608:x3F6n80W6uGKLrHgbX45JAt2Dg1Cc+kRf7ACPf:BFREcXwXQJAtn19RP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691389149, "uuid": "43a9d4c0-b8c4-4094-a935-7919257baf03", "value": 6983650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691389149, "uuid": "98bc6b07-c64f-4a9b-b7f3-acfc829209a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691389149, "uuid": "80742d25-2573-4fa1-9c49-f83f2aa1cc2f", "value": "8CFC890F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2ba932-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691414693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414693, "uuid": "164716e3-6bdd-4224-b5c2-bf8b9a6d8700", "comment": "Malware payload (AgentTesla)", "value": "71b72466d0a31e9614466c3c00391e58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414693, "uuid": "5a1de18f-697f-4d9c-93fd-ce12b3830345", "comment": "Malware payload (AgentTesla)", "value": "1f896398b69e22be7442bfd778d704b1e3b0961a51a8307e175d0876f8b67055", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414693, "uuid": "c17198dd-6f49-49ca-a654-ee377ecaa2d0", "comment": "Malware payload (AgentTesla)", "value": "89dd92e60ab59597744eab2f59e33b6223f6f8d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414693, "uuid": "3b0575f9-1b90-4a26-855f-1cdd55046821", "comment": "Malware payload (AgentTesla)", "value": "2d71d426cc4972d2abb3d12bac9525d67aa72a648ac60d6759c1eaac899bff2c2dd7469bd8b1e300f0298c4f5ad6e452", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414693, "uuid": "56140bce-5c88-4ef7-9836-92544808051b", "value": "T11BD42355216857A8FCACA7FE382D802A5BF2375DB4B1D32C4E541CCA43A3F495E91D13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414693, "uuid": "0359180a-96df-417b-a9f2-d67e2afd04ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414693, "uuid": "1f646604-e9a1-45c0-8989-dbb55e921cb9", "value": "12288:m8RyhyxZ4E0jZHRb3gZQOyeUskhr495QvjlqlCqqOr:lkhOyj1djO0sGvpvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414693, "uuid": "a335fca1-3e49-473e-ac1c-6bb3c467ce62", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414693, "uuid": "5160370c-5d63-4568-b944-9dc23fe54bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414693, "uuid": "2b2a91a9-3b74-4e63-ab91-c8e70690fa21", "value": "FedEx AWB#5035323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65583bcd-34e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691386175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386175, "uuid": "286fb261-ff17-4364-b349-733706faf12e", "comment": "Malware payload", "value": "535512a47e3219d57900af6077ed7546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386175, "uuid": "60a4b4ca-db81-4156-92b0-48ad4abdeb5e", "comment": "Malware payload", "value": "200d0913ba8688a274df14af4508b0f4efb699be85142d597d85ee54bd50abbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386175, "uuid": "c21e9837-28fd-450e-a3dd-3180e8301917", "comment": "Malware payload", "value": "01f9b2004c2079aa47976ba3d4eed1ced5512941", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386175, "uuid": "6b05b2ef-ad97-40e7-a415-13c3309b8592", "comment": "Malware payload", "value": "f648cd1f82a1e75bac7ad64cf62fdf8044fd9fc376dd8b9b733d739f1ddaa4eb979b589612a3fc6d606afcd75433bc64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386175, "uuid": "b8308c78-fe92-403c-91b5-9548817dd9d9", "value": "T10383C70E6E319FEDF26C82314BB74A30A75933D527E196C5E29CD5041F6038E586FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386175, "uuid": "d8d1b6dd-06ab-4630-b388-d5ac6abcc6ac", "value": "768:DqkJeaV4ppRLcGjFRy1dKbAVMut/EbvwTeLv9eD1ZOT8yFdWKLIr7bj7ryxplKeu:Dq+ezR5uKgXj7GxTjzPerLTFB9q7J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691386175, "uuid": "9d067787-d6e9-4cba-96e3-e8fc8785e753", "value": 81896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691386175, "uuid": "d8911465-dfca-47d7-a63c-6d0cec939c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386175, "uuid": "f353acf8-14ef-4757-80c5-16e5306bd598", "value": "SecuriteInfo.com.Linux.Siggen.9999.22122.18957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55a2ba9-355f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691439621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439621, "uuid": "c802a669-1f3b-4c2b-9ce0-2e96c6979855", "comment": "Malware payload (DCRat)", "value": "2a16891494cd20fb9f5f3202c24ed4f5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439621, "uuid": "9e95c5cc-beef-4b3b-a9ad-d815289a5206", "comment": "Malware payload (DCRat)", "value": "20bd725ede571673a32e100ffb790347960eb364f1061ddf1cf1426fc402f5e1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439621, "uuid": "fe14f1f7-e72b-4323-b83d-312e2ea83f59", "comment": "Malware payload (DCRat)", "value": "1b60d71d5e723b0bf1e2334db84901876eb12d14", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439621, "uuid": "030e10f1-8353-4688-9dc9-fb6ff82cd8c8", "comment": "Malware payload (DCRat)", "value": "f3fe4dfe229aa7e20dd13f7c96e522d781f9a4940ab51d2cc19d832c5c680d011830fe6ec8582a0c4f372aff00a6f1d8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439621, "uuid": "b954e487-c25e-4194-95f4-6ee4945db02d", "value": "T15E354A027F44CE11F0191233C2EF454947B4A9517AA6E32B7DBA37AE69123A73C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439621, "uuid": "622f848a-07cf-4596-9308-0d4fdbbdd8ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439621, "uuid": "4ed814dc-8a0c-422e-a1ac-dc104d132c6a", "value": "12288:+u5YwU/SJ68g45t348EKN6+2umEosu6usXSqBORZsC4CgMuP/bByhsjs527HmhTl:+iU/SWOa8UEolsCNabcugs7YTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691439621, "uuid": "ccc247f2-fd29-4561-8120-1129633bc0b1", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691439621, "uuid": "08de0a10-c1a5-48a8-b6dc-3e98e5c464eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439621, "uuid": "10f96226-fb03-447f-869d-203931814cc3", "value": "2a16891494cd20fb9f5f3202c24ed4f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d6b5f6-353a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691423542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423542, "uuid": "9d621139-d244-4b95-9271-5e29afbc63b9", "comment": "Malware payload", "value": "82cf051811579ee4f1d9978af52f12db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423542, "uuid": "2397698b-1858-40f7-95a2-bc65c15c3a91", "comment": "Malware payload", "value": "2227d5b2e2782a03bdb847a8ebf9ea40cc2c9f10f48385154c66ded1577b1deb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423542, "uuid": "841b3caf-cde3-4f06-87f4-0202bdc03e27", "comment": "Malware payload", "value": "34122975ea9238001cb644955a1474f4d33f9e7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423542, "uuid": "6c87515a-bd30-461a-accf-de1cb92be57b", "comment": "Malware payload", "value": "36e4b6918618518cc242eea06e7dd3ae225061d9009db5be3d781fc702ff085f9eb88a9fbbe92de680010129569b2730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423542, "uuid": "5ffcb293-1646-4b6a-9d3a-090ea50acea9", "value": "T1F9B5AF217BA29276C57306706E1CB31DA0BDB5B00B3546DB63DC1E6D2D704C2AA3E7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423542, "uuid": "d57f639b-480e-4656-88ae-e89e2745b02d", "value": "d5385158ebad80896ebc67b40f1bbb77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423542, "uuid": "61787497-6988-4f3e-ba5a-cabc4df48be3", "value": "49152:M32RUvjn/TCGDQiMDpU/Sb8HDWSrbmnidPtrmEKhPlGRr4g0aQ7svt/:nyn/+GDhOcSb8HDhrK8rtGlGRr4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691423542, "uuid": "b23cdf59-1dc6-4709-b9e6-cea44cc33143", "value": 2473672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691423542, "uuid": "2d60acad-ca4a-4600-9b88-c8556a0bd84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423542, "uuid": "fa2276a7-9ccb-49d1-b5bf-be288aac62dc", "value": "82cf051811579ee4f1d9978af52f12db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8266c9de-34ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691377205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377205, "uuid": "1de831b4-b555-44ff-bfb8-3eacb5b0d068", "comment": "Malware payload (Mirai)", "value": "62662baf9cd8e1fbedf273c7251bb705", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377205, "uuid": "a7d3d7ed-39a8-44b9-8f05-e9c8e631ea3c", "comment": "Malware payload (Mirai)", "value": "24f7f7139594fd6b7414c5b35efe88ca2f05e8fb3bd18c0348966eb198848f32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377205, "uuid": "7fb59e33-d2fe-4b25-bf0e-7ebb7347588f", "comment": "Malware payload (Mirai)", "value": "cc8e80f6b3612608b974da50278d91931d6d4b6b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377205, "uuid": "6e1b85f0-944e-4955-b589-b1cbe2316dc0", "comment": "Malware payload (Mirai)", "value": "8bef11e816aee9a5f5e4f7c2fc76efdae7c4e7d454b8247e2858bfdc7028e561312986fbae86f498f9f535dce5d573f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377205, "uuid": "2d1686b9-61f5-425d-a347-3ade5a5609c5", "value": "T1C4337C86E743D8B2F94741B6607FA7738332E1351076EB46CB28E436ED12910EA1B79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377205, "uuid": "c46ad43e-7ec6-4801-a58a-c6d786576da7", "value": "1536:/hjp8vOY0wBVO+4qWmfeJOJsLebNp+SpNjNSNm:/i0eO+4qwOJ++NpBPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691377205, "uuid": "7ed5c008-8878-4f54-9307-b6c9a95e4599", "value": 51828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691377205, "uuid": "0ffa7e48-8629-4773-8172-86dad994772b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377205, "uuid": "23b3ac44-0264-4080-aedb-dde61c1faf30", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed19449-350d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691404176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404176, "uuid": "17937323-9e04-4917-9f50-a68e29191787", "comment": "Malware payload (GuLoader)", "value": "b9c1f7d7b68ded154853a9c0e383936c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404176, "uuid": "6f453299-5ffb-4673-b2a2-6228d25b11bb", "comment": "Malware payload (GuLoader)", "value": "252effc64bdd5d7ab09fc4a19ca4c611933e92b1f5dea0acf171866a303713ed", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404176, "uuid": "b6e00166-fb3a-47d1-ab9b-17efd687d261", "comment": "Malware payload (GuLoader)", "value": "e751472b3dca59a8490ca65bcc753b936319018e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404176, "uuid": "a2c6ce09-ec30-450c-acb2-ceef47208e87", "comment": "Malware payload (GuLoader)", "value": "c0cea55adcfd37800f0d7f9ba8e45abef5937e2cacb8fc8adbe75157881ad5cf1c01bd4b2bde9ba10e834199cfbb0836", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404176, "uuid": "4fabccca-c18d-4f09-8090-0b7276ce874b", "value": "T1E64412FB2BE342EAE856D76063FF0E654092731526825C19F98170E6EF17BB3594F202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404176, "uuid": "83ca3182-678d-4863-af33-c4bd68e803bd", "value": "6144:G9sE+sIjCTAfJK89/2JXgnc3uiMQsYeihu+iyp6sRZ8w+Dqc:G9s3BrfJK89/29gceM/eio+iLsRqDqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691404176, "uuid": "996454ca-812c-42a8-ad73-fe9fc6930bbd", "value": 271504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691404176, "uuid": "9047a0d6-51bf-412a-a54b-2262ad84a6b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404176, "uuid": "a2302f44-4821-4e81-a83e-78f29ec039b8", "value": "Payment-confirmation-copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc58854-3539-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691422963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422963, "uuid": "2011d1e7-a177-464b-8dec-fd04f6915d60", "comment": "Malware payload", "value": "c4d026c7057b9b9fcde18d85fb486b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422963, "uuid": "2062f70f-9cf2-4266-8f64-f2b8822068d0", "comment": "Malware payload", "value": "265cb456cf5a09ad82380cb98118fb9255a9c9407085677d597abd828a5f4b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422963, "uuid": "45f45636-a403-41c6-8264-49441128b013", "comment": "Malware payload", "value": "43c111534475720f5e38ff8bddf29e4072fd9021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422963, "uuid": "3da9b055-e814-4846-a628-ae9a2e71fadd", "comment": "Malware payload", "value": "47b5351b4f2ce0816dd0491339587322fbebff2bc2806fa16066ef109c1b6a2df30c4cf4d06ed34419b7ac811d829496", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422963, "uuid": "629d0101-d2ca-4211-a07b-7eca8b135547", "value": "T1BF940507A6DC3CDAC4B25238A77B47C1D72DFC4513A1C6AF02E40166AE7F5927A26BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422963, "uuid": "9e300d30-034c-4e26-8553-1eee700efd0f", "value": "1c4fb1586de2649012792d8327d69979", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422963, "uuid": "35844405-9308-4a81-83d9-8f8ec986ce44", "value": "6144:bWEtgBxJxw6m33royaUkGmwigYVgRCmyb47TT+YK+YoI:q4gxTm3UBU8gYMfTGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691422963, "uuid": "43e1441b-efe2-4d5f-b182-f5096decee6a", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691422963, "uuid": "de24c98e-3131-4570-ab3f-1abff6d6b0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422963, "uuid": "a4b054cc-5418-4510-925c-8a73dc9f6de6", "value": "c4d026c7057b9b9fcde18d85fb486b4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0956ba3-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691414675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414675, "uuid": "e8a45b2b-a663-4ad5-ae5e-e502df009230", "comment": "Malware payload (RemcosRAT)", "value": "391f46efb537dbfc04e5147c2ad117f8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414675, "uuid": "9ef6e299-42dc-4200-9647-c894f9011372", "comment": "Malware payload (RemcosRAT)", "value": "267694c503c2edc13ad28b38f4d37063fa678db1f2bf4c1acbfed01ad8f43e4d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414675, "uuid": "c82b64f6-1c8c-4187-a5dd-89deadca350f", "comment": "Malware payload (RemcosRAT)", "value": "dd022f3589293c7ebd48c59d87ebad7cedeae85f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414675, "uuid": "bedd0523-0ddc-4edf-8717-7183ba997fb5", "comment": "Malware payload (RemcosRAT)", "value": "8961916fd6168b9b0b02779232736019e20e593162b86c18e11939d6a03eedadae1bdde2527ff71e8c2a3da617c282dd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414675, "uuid": "fc657ca3-bef7-4b33-ab3b-79205f1b4ea2", "value": "T1B1641265D5D5C43ACDA30A70523E4A59AFF2F11930A84B0BEF5015AD3D33A64AB0FB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414675, "uuid": "a78b19f3-efcf-4dd9-a6a0-58f1d3a5688e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414675, "uuid": "f2835ed5-1ad4-4347-aa1e-20d6fafaed6e", "value": "6144:FYa6fQVA9ij1fx53NpPW/n/DKEerVkB/nvRd5x0EBFG+gaV:FYsA9ix53PPU/uEerOHRdxBFG0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414675, "uuid": "943a164a-f4bc-4e23-8398-f3be014314d9", "value": 308212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414675, "uuid": "88beba92-739d-4637-b736-4702ba1f7bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414675, "uuid": "44b8f6bf-b5f9-4f4b-8296-c520abf6c952", "value": "DHL Express Original Shipping Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7481a3ef-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394791, "uuid": "55542e2d-ac14-4f35-8e26-4f7f17a62afe", "comment": "Malware payload (AgentTesla)", "value": "b1c3ef42c0ba347efd7327799ef93d7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394791, "uuid": "0df42016-ecf7-4e88-8bfe-2b6624e28307", "comment": "Malware payload (AgentTesla)", "value": "271ce87a51455a5d214a9dc4475cd9652e6159c0a5c79a0c222b1d0c27a7ceda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394791, "uuid": "1b70fae3-1c28-428f-bf5a-943479d454ba", "comment": "Malware payload (AgentTesla)", "value": "03925df0c7fc0ad8e26828795a78a657aad73585", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394791, "uuid": "e533962d-771c-476a-95ed-df44f602cf8b", "comment": "Malware payload (AgentTesla)", "value": "fcd1b88786ef20abaff1bcfca8349f995b39c6fd7e9c24745a29f3e5c3f985707650dd7bb5b44f85da78686b5faef41b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394791, "uuid": "69da56d5-50f9-494a-aebb-6f32417bf1ba", "value": "T1BC459220DF7B1405EE9692FB4A7F5C7A74D9BC80F1A5C9D83296380261A231CD923FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394791, "uuid": "d3fbbf2f-5a73-4959-93ef-835abee99cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394791, "uuid": "543cac74-f865-4bcc-8f40-0b1c0b5cb01e", "value": "24576:yocAWSmFERs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOZOguMDpBr22GlG:vzRs6CE3jLbO9Rs6CE3jLbO3uAiyyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394791, "uuid": "57ebe6d1-155d-4d6e-ba8a-89aa97804970", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394791, "uuid": "5180eadf-8f2b-432b-9be7-8f011b799e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394791, "uuid": "df8f5a55-6017-4690-b323-cacd042a08b4", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cdceeb-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691394798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394798, "uuid": "46e3f1d8-96fa-40a5-a2d7-98f4a3b24f17", "comment": "Malware payload (DarkCloud)", "value": "d2d751d07698bf1b94f4396eb2f290a3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394798, "uuid": "db1130c5-4d1e-4bed-aac6-154b4a2bce21", "comment": "Malware payload (DarkCloud)", "value": "271f99b3aa0cfb6916f6297e02f0d31e601acd4549ba536e7efa633c67c4a185", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394798, "uuid": "9e2e3ef8-26f4-4bfc-8874-3a969ccdcfac", "comment": "Malware payload (DarkCloud)", "value": "b598d99be6262aab93b5584e174896be2f5c714e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394798, "uuid": "7433049f-ba8b-4bce-940c-59936efdf445", "comment": "Malware payload (DarkCloud)", "value": "7617e95111d487a9255812768ad3e553838e3950c8879e89c4de5e16abd475352bff19b90c9081eb6136bd77177f6577", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394798, "uuid": "0546a85f-212d-4163-9ff0-ef0d372d7583", "value": "T1F305124BB928D4B7F51934FE1C16820403B12C7965A8F2C39DDC7DEA2972F8897135AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394798, "uuid": "a3633452-c66a-43af-ac51-7f8a98de1c89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394798, "uuid": "be07de38-e7e0-4163-90b4-7d298ab3f830", "value": "12288:NySXWqIi8EG1tamOidEun+BgZ962FlFstBiuVcLsRBQAk8iXOpRJaN8Ia:QNqIbcun9WOFstB9c2QAk82O7sN7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394798, "uuid": "c37d4c51-2e79-4d31-b5f5-c018fa0d9f88", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394798, "uuid": "faec59f7-55f5-4ae4-a372-a0ef792e398c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394798, "uuid": "dee5fed4-51d1-494c-952e-d438b25f4f16", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8488699b-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691372484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372484, "uuid": "5bbe914f-bd61-4fc5-a581-4a079e8a305a", "comment": "Malware payload (Mirai)", "value": "e08de86125e2e4af37b09c9e457255ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372484, "uuid": "a114b6e2-3840-4744-a295-109906c91843", "comment": "Malware payload (Mirai)", "value": "28e61c0e43e0a155e04bab2638bd5afc0d989627389903e52e3b08f24c078e97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372484, "uuid": "7dbea252-bba8-44cb-9969-fcc5462233b1", "comment": "Malware payload (Mirai)", "value": "993918c15dd643b16d1672538d37276d6a673d79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372484, "uuid": "f9543bd5-749b-41b7-8663-5eb77deff631", "comment": "Malware payload (Mirai)", "value": "58d83e557c27d70e8e1c06ca63f6fd32bd0babce2e4c08aeff20f28c838d8e6c25c14fa0afe1bf7769e7527853ec2636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372484, "uuid": "54f79c47-c3d3-4999-832f-cf3e752caaaa", "value": "T15B535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372484, "uuid": "5ac3457a-98b9-4782-9af8-3a8e85b8e03b", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8Z:N1GjR8EVGOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372484, "uuid": "f4783fb0-f8c5-4bf4-a0b2-a39ef3c0da65", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372484, "uuid": "2d53b8de-5323-4d46-b7e7-c6c72f5767f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372484, "uuid": "986d0505-0893-4ded-9603-4b374db1de70", "value": "e08de86125e2e4af37b09c9e457255ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10744010-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691381308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381308, "uuid": "b2fafdaf-2905-4621-a30c-30a4ed57570e", "comment": "Malware payload (Mirai)", "value": "1f67aed55d0d2b25c25e15fce649f699", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381308, "uuid": "d0a67eb8-1fc8-446f-abd8-9598a6b562e5", "comment": "Malware payload (Mirai)", "value": "2a00e74ba3ea0a1af78a6d0a08ee7710bd47a23bf4dcd3e55e9632322affb834", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381308, "uuid": "4ecb327a-0dd3-4933-80f1-da6b80418d31", "comment": "Malware payload (Mirai)", "value": "4aab2ef3d3d9a66b0f530b80f806be67fd1622a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381308, "uuid": "13afb5f1-c8ca-432a-9f7a-bf2b88893eb1", "comment": "Malware payload (Mirai)", "value": "3bc9d3738ebff4390b98895edc7a0e38052afe5e70640829efd0e0ff250d8695a42ba325f3c24b228f35860eb9e81c8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381308, "uuid": "50b6db78-e66a-4841-8c22-71e794a9c8c0", "value": "T178532985FD819B12C6D51177FB5E42CC771A0398E2FA32039E2AAF3127875660F3B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381308, "uuid": "3abbf6b7-64d4-45c7-964d-0a4f34818017", "value": "1536:RtgoTMnCW9T6jpjHd0D/7wP5O/5bMiCESRxvZqs:H1MnvN6lLKD/E2/UZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381308, "uuid": "1eb13655-7ad5-4488-bdc9-edf4e1916c93", "value": 63052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381308, "uuid": "c459dd99-1570-4f15-9ac6-ff74b8ac5ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381308, "uuid": "77677c24-2e14-4f12-8fe9-d3154422cbe9", "value": "1f67aed55d0d2b25c25e15fce649f699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23910639-357d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691452207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452207, "uuid": "bcf6a077-c6b0-4e02-b75f-359358204c9f", "comment": "Malware payload", "value": "2d03847e07acefd20326fb45c6408fac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452207, "uuid": "6e556d21-429e-429e-8286-3a5a90d9b282", "comment": "Malware payload", "value": "2b52c9167188ab79e58af67e58d9790f8a9c86a4aa6a17007c79b5d093ea2606", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452207, "uuid": "05ba0eaf-4d72-4eaa-8e07-e1038a6d079f", "comment": "Malware payload", "value": "48e67103a01eadee43cc34936ac75da96542f926", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452207, "uuid": "ecc44ae5-6b9c-481a-bea7-80e20c678526", "comment": "Malware payload", "value": "05f7b3c9a8ce842390cff7d444326df8b1615f26f15b3ff7fde4cf96ed55e81dce240fe5924c29cdfdb3eae135d0d193", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452207, "uuid": "f68792f2-1df1-4274-96d8-c989b2fc486d", "value": "T13053F991BCD19A2AC6E023BAFAAE518D332163E8C1DF3217CC111B547AD651F0D77B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452207, "uuid": "ecefccd2-88eb-44a3-81b4-684f7df379bd", "value": "1536:N+nurXpcpslWrq5FPfFtBfioQWdGE3ljN6yLahWbjYoQUv5v6505j:QnTobcEpcyWhIMUvM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691452207, "uuid": "1f851517-5e2e-4ca8-bd0a-4b69973cab7a", "value": 63112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691452207, "uuid": "0a04eb9e-6aa7-409e-9cc7-7b3ce7db2879", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452207, "uuid": "94d02df7-37fa-42f5-b716-80e3bab9f331", "value": "vcimanagement.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d295a1b-34d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691378914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378914, "uuid": "ecca80e4-0941-438f-bf74-d501438f7459", "comment": "Malware payload (AgentTesla)", "value": "897253534dc9456ded04a6cde98cde06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378914, "uuid": "fae55fe7-d518-4c5c-aedf-b8b4e2ad4ef0", "comment": "Malware payload (AgentTesla)", "value": "2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378914, "uuid": "62e5d17b-25a2-4aa7-8c6b-54f89b42e1da", "comment": "Malware payload (AgentTesla)", "value": "a42327e7ad2a570e7c5518fc7dd0e27c280c8d39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378914, "uuid": "3fb126cc-9acc-4c74-904e-bb9a1e33dfe4", "comment": "Malware payload (AgentTesla)", "value": "229038b8700cd8f77355fb91b48e388077513fdbfd87673cce636d34d2a705ff2d65bafbbc673d8055b966b7bd06778d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378914, "uuid": "b0dc9770-5730-4f70-b2cc-29a062ef5f58", "value": "T1AAC4120D716CD7A1FFBC43F97878419803F572046822E2AD6E945DEE35A6F2E9E01A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378914, "uuid": "9cd809ff-67b8-467a-9d6c-08f6ac230906", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378914, "uuid": "77744f6e-a5a7-4a09-8b2a-453e4c22a3b5", "value": "12288:AcnRxaS2pVCySQwjaW7CbKzVGFna3i2YZd3K1:TnTzzySbjRzVGhaoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378914, "uuid": "abdd7cbc-d59b-42cc-8536-8fe88a5bffb2", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378914, "uuid": "a88a9a33-6474-461d-9510-f507f112d188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378914, "uuid": "1bef0de9-2884-4ac4-8caf-23f1f1da29ee", "value": "SecuriteInfo.com.Win32.PWSX-gen.13197.31351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dc747d-351d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691411327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411327, "uuid": "15b6b45b-8f15-4efc-a1a3-f00e09b40b7f", "comment": "Malware payload", "value": "c1a42e8c10416c7c4e5c4aeb9b0f0f35", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "JPMorganChase", "colour": "#D86D0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411327, "uuid": "ef8aefb9-f17c-4698-a3b8-76606e712b83", "comment": "Malware payload", "value": "2cfec021b06404bdb56e855db49658aaba35ec7d3be500e5c86490d57ca7e7c5", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "JPMorganChase", "colour": "#D86D0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411327, "uuid": "63b9c638-10a1-4cad-8cf6-91841cd109ae", "comment": "Malware payload", "value": "cee0a7cc1bdc8ad380095d6b847806e17691ee79", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "JPMorganChase", "colour": "#D86D0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411327, "uuid": "056cd1a1-531d-4dfe-a412-47ce767db9fc", "comment": "Malware payload", "value": "d41d4fdda249e7b26028a0e8ef36c676a23047b637e213220513d42ee57d92e776d55c95dda8bec4e45a97740fedbdb6", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "JPMorganChase", "colour": "#D86D0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411327, "uuid": "2d1abf37-dec1-45d6-97fb-0ddcbf7c9eaa", "value": "T14665120963D821ACE56A823484664751FBB6B8352B315BDF31ECC03D1F236E5AD39F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411327, "uuid": "bdeacf8e-2936-4526-87c7-74881bcabf26", "value": "24576:yJw1BOEcyh7Ovt98eSYrkCPDM9ug67fEd9J9XTLczjRABG1+pCAfSDu+bUZF6jW:EoBOE76al+LPDKBIsd970+p7t+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691411327, "uuid": "3e2c1eed-9fdf-4d86-a1d6-f13eeb3f1724", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691411327, "uuid": "ef52e3cb-f65f-4bd6-a646-935ae6ae3c4e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411327, "uuid": "3274751b-6209-4bbe-bbb1-8b051907178a", "value": "code-of-conduct-JPMC.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a835fca3-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691414205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414205, "uuid": "13150c67-3052-4026-8660-2b7649fcd795", "comment": "Malware payload (SnakeKeylogger)", "value": "88558239003de10b2342502825ed5d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414205, "uuid": "0b1f49c1-ada2-49a2-8f13-b35aaccee8a0", "comment": "Malware payload (SnakeKeylogger)", "value": "2d397c3b96952610182b2f157200c188b1f816689dda18ab175b813108acce13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414205, "uuid": "c8be4668-c3fc-4a7a-be91-d6d4d18e73ab", "comment": "Malware payload (SnakeKeylogger)", "value": "9f41c6501d79aa62d74d503497fd9d4d8fdbc320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414205, "uuid": "28406145-2c66-44b7-8453-a66cb7d3fcf3", "comment": "Malware payload (SnakeKeylogger)", "value": "c88a81c932a201869c0899847d51552081d2d030242b7a872a453f347a75a31558a98412fe65c364f4d63c6eb9decaff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414205, "uuid": "587f30e0-26e2-4a6e-85a2-9df96cfe3c7f", "value": "T199E4B30FBE478DF1D3475776C69F44044BA9EA81262BDB1F7DCA239638037BAA841607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414205, "uuid": "6a4a3305-7c82-41ab-954d-d6fe9875db6c", "value": "12288:GpSFXvfq9PrHrTUA2IAWSMgJvjl6l2GRwLfQ9:CSFXvfqt3AbXRjl6Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414205, "uuid": "a38241ae-27df-4444-9cbb-707c61eee5da", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414205, "uuid": "1d16df40-f400-4324-914d-f10f14701c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414205, "uuid": "a21fe7c8-d762-4ae5-ae0a-ea38be2e2ac1", "value": "Ayuaey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e9aa2a-34b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691366715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366715, "uuid": "e0f698a5-9a02-488b-aef2-c59f36e378a1", "comment": "Malware payload (Mirai)", "value": "a3dda5ab33e05606a79f46bc72bb2de5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366715, "uuid": "d3cf120f-d03c-4971-b90b-a33887da6a91", "comment": "Malware payload (Mirai)", "value": "30442f6a2dae3a1452647fa296006361c632a5c47972ebb1f03a7d093e9e442d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366715, "uuid": "f2de1aa2-bbaf-465a-859b-520246becf82", "comment": "Malware payload (Mirai)", "value": "04afbf77747c46f2b32d256a945131b65c863cd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366715, "uuid": "0e87616a-7fe2-46db-9a46-319372577716", "comment": "Malware payload (Mirai)", "value": "ffd82c0786b6efe67cdf1fa42f536383721528d59b4171136fd48866916c3a6f2926cb7eb1e9179163400e0cd60dab85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366715, "uuid": "cdd4d1ab-41b2-4822-8d65-ae1611c1cbd6", "value": "T132B2D1A48B959706C2B0B435A27C8F925B3B15A0C6F739271B2092FCDB9245633BC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366715, "uuid": "002e0c4f-1ccb-4fef-accd-72a295c2afd0", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BScISIhymdGUop5hu7o:4GHKQFH0rs3zWoDDRsjt7LB9U+BScdIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366715, "uuid": "1770ef61-89c4-4544-9193-ac83a6c26364", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366715, "uuid": "e224bd09-3eea-474e-8c4e-105f58be9944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366715, "uuid": "f293c72f-f1d2-414d-8e26-cf86f91126ba", "value": "a3dda5ab33e05606a79f46bc72bb2de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650224f9-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691394765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394765, "uuid": "4a7f4a41-9955-4c48-a68f-bca847a50b85", "comment": "Malware payload (DarkCloud)", "value": "c167acf64d8585628524d3041177ef50", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394765, "uuid": "fe749ebe-8ffb-4dc9-b94f-3cac35fc0d55", "comment": "Malware payload (DarkCloud)", "value": "315d85b36b382335d26d4c87d3d2a556343ad2777078855d1aeead851b8a49bc", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394765, "uuid": "b11e7aaa-5d90-43ea-9ed2-d208bbdea39c", "comment": "Malware payload (DarkCloud)", "value": "2097d0790d3124e6bd14291371e4a04e24e42af3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394765, "uuid": "7c348dcc-a27b-4576-b302-81fdcadff39a", "comment": "Malware payload (DarkCloud)", "value": "5dc5ff2ef58dcfc18675070110f7ecb24702c21578b3885e9dd691b0589c385242c2949a1315f77c9cb3af02c9ab721a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394765, "uuid": "ccaf879c-203c-4750-8f0e-0b59cad3b7b9", "value": "T156A41816FA10712EF152C9F1E9D4D27768252D3611A8A8ABFBC15F4A31359D3A8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394765, "uuid": "1ca49167-2419-4d85-80ca-f2e4aeafbd89", "value": "f04087517a52194138f935fd462dce1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394765, "uuid": "e103ba89-f5f9-4fc1-b799-bff4c36fc11d", "value": "12288:HSmMj6NRC7oI/ItgP2xAOld+P4GiRGdJjYKkJj6GmZU:06NwoM4d+P4GiR0xYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394765, "uuid": "f9a1c7d6-9ace-429e-a784-5ea9e6243631", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394765, "uuid": "be318086-94b7-4955-9d2c-80a5b332d119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394765, "uuid": "76b8b116-a648-4879-80c5-3057ed99eefc", "value": "315d85b36b382335d26d4c87d3d2a556343ad2777078855d1aeead851b8a49bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d8eef2-351a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691409716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691409716, "uuid": "c86b7be9-2353-4d79-b030-dfefefb7a1e2", "comment": "Malware payload", "value": "8844052b4a157b401c314d24d06c62b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691409716, "uuid": "98a2a2c0-0de2-4159-9d1f-fa334c29b6e8", "comment": "Malware payload", "value": "317dfe400a771cd8fa1df661043ca17f04b80a45b792409d1942efcea538c6e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691409716, "uuid": "5b424eaf-9d6c-4ad0-94c5-fc974ef495f5", "comment": "Malware payload", "value": "06022d4feed783f70199ead270ee7b3db65ae0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691409716, "uuid": "a68b3f0c-9cec-4415-b17c-949e654f6311", "comment": "Malware payload", "value": "aed89087c77aad15ac5db628b82d0c74706c67e682be1c7a52259037a32ae41e699d0b3d2e638f6d6e9ab881918f0623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691409716, "uuid": "82d49c05-8154-4ac9-817e-2e057cba00d4", "value": "T17772D81BABBCC31DC6288B311DF253D302BAB3046670D79D598F27A664563398751FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691409716, "uuid": "f3c8dc85-0630-4cfb-a50a-dd6406e8f6ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691409716, "uuid": "f09b0b17-2a98-4077-9dd2-94484b8a0c22", "value": "384:L9+ApF1gfs+dwYGbco839ZphAerY13wO0l:L9lcfs+WI7kwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691409716, "uuid": "62a9f10a-3293-42df-b476-b8af3e1f74d6", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691409716, "uuid": "cc94969e-934c-4030-80a0-6de27ccf5335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691409716, "uuid": "796dedfc-e0a8-4759-a623-e958e0d2ebff", "value": "317dfe400a771cd8fa1df661043ca17f04b80a45b792409d1942efcea538c6e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6d720f-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691414054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414054, "uuid": "0f8ad529-4d68-4ad0-a8fe-a53633bd48f8", "comment": "Malware payload (Formbook)", "value": "f1a11c761c5464675a03e9a9d669e0b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414054, "uuid": "6460afb8-4b65-41d9-a47a-0d7fd3ef5334", "comment": "Malware payload (Formbook)", "value": "31aa8ca9f4fcb46b8028c97aeae2b7d7285f27f8240c0ad5f3e0f08282c8a3b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414054, "uuid": "6b7a4d32-879d-4800-b4ea-bee39714eb3d", "comment": "Malware payload (Formbook)", "value": "389b1993b0aacec078bdd97cd939658daa9de3bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414054, "uuid": "e6ab9529-08e3-4e17-8dcf-25fddbb17257", "comment": "Malware payload (Formbook)", "value": "7b990e2b96c8e71e0f8e59234b3dc8a05a71f4cd1f7475a334284b37190055017f92aac7ea5e2744744a50e5b33ea286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414054, "uuid": "5de9e948-43fe-4599-a92e-ccbe717ec089", "value": "T157E33ECD31788271CA37CFB0DC99C5F2A2A11E86138CDDFE4A802F6734D1E5A5619A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414054, "uuid": "f4c7b48a-5022-4aa7-9f9a-66a2dc01241c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414054, "uuid": "0a7e4600-01e0-4059-90ce-2cac2dc12c31", "value": "1536:UFD7AhLMtbigaxGOyAN2G6Dbi5WkJQmyia7Z7E04g73K6/b:eD7qLMtCAzb6Jlg7rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414054, "uuid": "d5d377b0-2261-493d-bd03-2341156f9167", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414054, "uuid": "83dcfc52-7e9e-4dab-864d-9d0c3f88912d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414054, "uuid": "886bbfef-da27-4477-89f2-e2aa04d14986", "value": "31aa8ca9f4fcb46b8028c97aeae2b7d7285f27f8240c0ad5f3e0f08282c8a3b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80eb7a72-34d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691378920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378920, "uuid": "6c13ffe8-4885-4137-a6e7-1a621ddc72d6", "comment": "Malware payload (AgentTesla)", "value": "8d460e5990cf9c33f2a60eeef3cd1975", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378920, "uuid": "a32c18f3-91c6-4452-a95b-4a11ce087508", "comment": "Malware payload (AgentTesla)", "value": "3441f09f92a9f9234013c0a3484c812f4cde252c191f4212bc24c81f04e7874f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378920, "uuid": "3f2270b1-ebdc-487a-bc8d-0b8971909925", "comment": "Malware payload (AgentTesla)", "value": "95e97c21a352800676d23d1798d9f4a655ee2515", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378920, "uuid": "de247391-3cc7-4efe-a3bb-85f26b13af86", "comment": "Malware payload (AgentTesla)", "value": "8be4ab1821ace119410202e1b2cb94c3290eb6938dd85a80df26e297acb737e428ed9bfd963eae81348770b2a96ef225", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378920, "uuid": "9aaa6f2c-0ad0-4582-b7c6-5cd382527f49", "value": "T1FDD422147DAC8B25EDAC07F73D7A462803BA324D4616E31C6FA55CEE1A62F4F5B10A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378920, "uuid": "acc67add-d6ed-4461-831f-243337bb3cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378920, "uuid": "71657789-eeae-46c7-98a4-e2ab1aca6ba7", "value": "12288:yyHMGVyoJIOLgnnyRpqIV3H+EAX0u/gQ8D6n+09biRSYfFrX:nJybyrqS3uD0D6nNJiPFrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378920, "uuid": "c38b375f-2108-4d7a-a05e-2b4772b6c431", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378920, "uuid": "5cf8d208-9b29-4cb6-86e6-6d16f5e7d2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378920, "uuid": "0a0a909c-6d36-4c92-bf04-d0667ac8c4bb", "value": "SecuriteInfo.com.Win32.PWSX-gen.15182.6073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de93d7e1-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414725, "uuid": "e2d646c9-fa75-46f8-8f19-eed822a8cd37", "comment": "Malware payload", "value": "490088dcd48c9a5f86a1b9bd521ae7cf", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414725, "uuid": "8c6795b0-9e52-489c-aecb-500b95e43f1a", "comment": "Malware payload", "value": "35c686cb71a962894c9268f4bf6e0b6071876e0378af02b40779a46ef340a583", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414725, "uuid": "ee215d8d-082c-4cb9-b5e7-9275a84a2781", "comment": "Malware payload", "value": "a34d7988502af2adec27490e6daf7fe311510b23", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414725, "uuid": "4c812ff2-0fe9-4295-acdc-ae5229391e9a", "comment": "Malware payload", "value": "4b25cefb3d3973b866bdf0bf65bad9df7b13b46b6fa9f41724e79db0ebfb7d9f2654256d252fe0dce6ae08ed0c0f23c7", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414725, "uuid": "ae59f2f4-541a-4b40-9f7b-95103652ae11", "value": "T1CEE423D5194287A3ED08D1A6B8BA68B1903DB34D2ED36B30192DD14150FABB9170EFBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414725, "uuid": "0a7b4d2e-07c8-4a5b-b3d5-ab93277f89a1", "value": "12288:v9nWtttWzC6kbUEC9qUa4OJYjoI+Qsb1goMK1sUUHAanU+8kVCJatF:ljC6kbOQD6oI+B1LMK1sUUgakEi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414725, "uuid": "6add570f-b3e2-4a6e-b466-ac767d1afce4", "value": 712662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414725, "uuid": "3e5893af-e693-4043-9fd9-059dd71517c8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414725, "uuid": "ec58f6f8-b372-482e-b323-4220f4850a06", "value": "79076889381.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9cf142-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691395400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395400, "uuid": "fbb8fbe1-e621-461b-843f-480bc6280699", "comment": "Malware payload (Mirai)", "value": "b5e6267e33c025d463617f16beea1cd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395400, "uuid": "5e46afe3-100c-4819-8c58-631c35ec2a0c", "comment": "Malware payload (Mirai)", "value": "35dad7e7eea975d6d7a24af42654a8c49386a8d89aaadc8d05f58286797c1178", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395400, "uuid": "685bee75-7b17-47aa-b9ae-31262e850dc3", "comment": "Malware payload (Mirai)", "value": "051d27dfc86fd9f1d703e7aa122a70d770bf6848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395400, "uuid": "8882bd9e-9526-4664-ba03-d339eca4dac8", "comment": "Malware payload (Mirai)", "value": "d4920d69506cd3cbe2f8b3b4d079c058ec834cfa7b1fc81dcd0e6d42a06344261f8c1584f8f8a81b23ce4667de4cf0ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395400, "uuid": "1d175115-b925-4991-b79a-6c791b8ebf22", "value": "T1D6535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395400, "uuid": "07bca7fb-4f40-468e-987f-9a22a220c4c8", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8A:N1GjR8EVGOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395400, "uuid": "89e92902-e0b8-45d5-9c65-777ba351e3a8", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395400, "uuid": "5dd2821f-c430-4298-9208-0500b1e836a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395400, "uuid": "98687a85-6016-4f2e-8475-7d6206a2bb3e", "value": "b5e6267e33c025d463617f16beea1cd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329f4927-3558-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691436341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436341, "uuid": "a2713ff7-e6f9-4c34-b907-683b4239b975", "comment": "Malware payload", "value": "ca29bb73b4c7d51edfb7bb2c226c7ca4", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436341, "uuid": "9d356338-742a-4a7a-a6d0-0f2eb11dd4fd", "comment": "Malware payload", "value": "361cb8e079f5cd01a74646b75e6bbac35dc2697baea520674cce73e87f9b2965", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436341, "uuid": "513a3c94-ce38-44b7-adc7-6165f3fa209b", "comment": "Malware payload", "value": "9d457220b2717531b5e00c80dbe974e754f08c81", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436341, "uuid": "e4860949-ae17-43ee-bc68-d5c7f9a86322", "comment": "Malware payload", "value": "60e6515f7597020d718152e5c51640acba00667dc0f23c2ea4715b959aa59cb2e9043c12052b976e7a02738221c1721c", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436341, "uuid": "aab7c054-8e6d-436a-b819-f4c8a8a8ebc1", "value": "T1F4315C3732B5020CC675463B54B5BA13D73AB80DE90B8B8E32515A7818181DCA925F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436341, "uuid": "93dc0252-28c7-4422-9c19-3ff98ca150b2", "value": "24:8NNZsxqnTPFN7oKzFaghW8zA+WeZ+/CW1ycIl7pEQeyTppTpZab/2XT:8FTPX8jTmcY7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691436341, "uuid": "2212e6d8-af5b-4f57-a796-fdbb0d45843a", "value": 1549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691436341, "uuid": "1fc2c047-c69b-4635-88c5-4bfddbcc8494", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436341, "uuid": "71eae374-e2b2-4ef6-abe8-3ef375d6d1ed", "value": "upd-bounce.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4794a5d-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392724, "uuid": "db5285c2-7593-48ba-8d96-12fd777df745", "comment": "Malware payload (Mirai)", "value": "19504386d65b74cd1e28ce8335224946", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392724, "uuid": "a77d302c-988c-4d22-a756-5b69fdf5c00e", "comment": "Malware payload (Mirai)", "value": "362638f8cc961f269de54c503a1e8557372f3015b22c957fdd202844f1e3d7d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392724, "uuid": "7f34288c-b46f-463a-811e-97c6e4eee881", "comment": "Malware payload (Mirai)", "value": "04190042ac32ce5cd724d2fc4dca3211f65cd8a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392724, "uuid": "0b814c18-a084-4a9a-abd2-d9f5bb9b72a7", "comment": "Malware payload (Mirai)", "value": "da5298f7c111bc25202c7c3654b02eb6d1d6afb0869099f2178a063a9ab3c4557ad9244c1ab034fb2c0c8515ab75da23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392724, "uuid": "7ed8c683-f052-444a-8b2b-1a06a7482418", "value": "T1AD13E684B8829E1AC6D0537BFA0E82DD372973D8E2DD7303CD156F5237CBA2A096B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392724, "uuid": "f8dff4d3-8a39-4003-afe9-2bf59c8338d5", "value": "768:h+dVv1VtO5PoG6wo5kolmBDQkgmOApMzJO4GEqTMi1cnHPQgx:IdVk6vjmNgEpMzrqobn4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392724, "uuid": "2ded4269-a797-4589-8ce3-c61c44bf5641", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392724, "uuid": "f2c55ce4-4711-4ffe-acfb-7722fb31028a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392724, "uuid": "021f5078-9ef8-4f96-85dc-0f2c48e637b9", "value": "19504386d65b74cd1e28ce8335224946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e31df43-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691394780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394780, "uuid": "ee34d1db-8986-4bac-bde5-a6b005c11615", "comment": "Malware payload (Formbook)", "value": "dcb5062cd488a32a867c858b7a193c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394780, "uuid": "43455e55-099a-4666-ad65-bcfc06bf6041", "comment": "Malware payload (Formbook)", "value": "365d4d8eda4998dad39b77a5e71d38bbd8e7002d96a748aa187826ec2eaa365e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394780, "uuid": "09172bb2-325b-4cee-8859-64c56719a21a", "comment": "Malware payload (Formbook)", "value": "e071ea8740614fe64e4d0f4078156378de3b6aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394780, "uuid": "45405af7-a15d-40fe-95aa-35eb0874ef85", "comment": "Malware payload (Formbook)", "value": "16b3753d8cee4072a0a126a466847bd6c4ed732b27c83165cddc6ca5a9d9eb3c01783810ff67826a418fab6eaac2a78e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394780, "uuid": "691c430b-1d54-4448-a39c-51b9106a8681", "value": "T13244021976D0C267E9A34F722D7E03375BF69626696C230B13012B8EB827097DD2F395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394780, "uuid": "fadda165-abc6-432f-a8d3-86a3ced5e4a7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394780, "uuid": "073ae2a4-cf41-4656-93fc-621031a71260", "value": "6144:PYa6nHhrJluVRhHT7uF7ekd7S0NRCX47bNK21lFxut+PokfWA1KkyP:PY1HhtlcF7sd+0NRCX47I8FxloWlUkyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394780, "uuid": "f0a641f8-28d1-49a7-a0b1-4d4150cea99d", "value": 257592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394780, "uuid": "65ee9b18-5660-422e-97f9-58655fa20cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394780, "uuid": "851b008d-05fe-4712-bd61-cb55b4eddb2d", "value": "Contract Agreement 01082023 Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c58704-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392744, "uuid": "b835fac3-13ee-492d-9d6f-ac370b8bf94e", "comment": "Malware payload (Mirai)", "value": "580b62130ab4cdd3f9f9ac04887aa48a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392744, "uuid": "7d44e2b5-7322-4f9e-a479-ea16125d076f", "comment": "Malware payload (Mirai)", "value": "378f54aa828e1375578145c024a0a7fa50d0909bba037d71751a51f373b5ea9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392744, "uuid": "45245e59-0f55-483a-a307-dc62d9348d06", "comment": "Malware payload (Mirai)", "value": "a88c561a1b34f5aad060456fa9080da3566ffbc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392744, "uuid": "b022cf43-10d7-4a38-a454-fc95358f7e5c", "comment": "Malware payload (Mirai)", "value": "6d1fbd2570b19ae94aefc907d412747fd47be4b54bfe4da088907f726c1168521d1f40a5b6c10ff1a98872d17d7cc458", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392744, "uuid": "aa6bdfec-76cd-4d78-af49-94f0b67318fb", "value": "T1891319287902B7FCF69600BCF01323B561B32E1C79DCE7E291837575EA606C4A975D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392744, "uuid": "660647a5-7390-478d-9e81-86d746cebf84", "value": "768:lWYx4jVLGSRo/jONSXu+80gnBjIuc4jVkJy:lWYMVLGS6iGB6Bj1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392744, "uuid": "f2aad064-b684-475a-976d-10e6e3d4cbd5", "value": 42444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392744, "uuid": "4831f3b7-c6d8-46d7-80c8-bbdf65287ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392744, "uuid": "47ef2522-a08a-46f7-a39b-55fffac359fe", "value": "580b62130ab4cdd3f9f9ac04887aa48a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a123f7b5-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691390571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390571, "uuid": "201ad8f9-9680-4be8-b04e-cdb69b3084a8", "comment": "Malware payload", "value": "186fff2af81977fd303aa77a65f7afe6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390571, "uuid": "7fb824fb-520d-4925-8dee-21868d9ac29e", "comment": "Malware payload", "value": "38b7a01005ff97837ae967f418c36869d253873893300840d5997e5e4f87da69", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390571, "uuid": "fd2df1b6-f101-41a1-9c19-8784aba89c45", "comment": "Malware payload", "value": "c55105de0feac7e708b5af22d04d7d96467214d9", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390571, "uuid": "4285d145-83ae-4de1-90db-184e0b819950", "comment": "Malware payload", "value": "e77edbb15c8a242b55dc6fef766e3abd936deb510c5ef2d68d436e6c0a854aee4f8cc069305c3868428551cbe55b4531", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390571, "uuid": "63884d60-e713-40b8-a1d8-17d6a426b3a1", "value": "T181D42368C504B037A19A2F3D3D17430A11A9763593CB1F782BA537A793F36AF2948D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390571, "uuid": "75ea2f68-2c6a-4e24-8ec3-fefc8976977e", "value": "12288:VvgsdZlOJu/9Cs38ql9Zx/wJj8qGYSFELJSnSYrg9v1GWy:VosbB78ql9ZqJj8qG5nShMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390571, "uuid": "29f70491-1244-4d3b-aa35-3e5ecdf40d45", "value": 646670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390571, "uuid": "b2dd9392-2a6c-4fa6-9cec-9121025479b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390571, "uuid": "062e6f6c-a7ad-4af9-b419-4a42e2c9c3e4", "value": "INVOICE.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935c9a7b-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414599, "uuid": "8d387e8f-2636-431e-b6f6-83ee0f4758a9", "comment": "Malware payload", "value": "0db2561abccbaa507fb524738498a103", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414599, "uuid": "db708e40-fc99-493e-880d-a548b2ed2030", "comment": "Malware payload", "value": "39c36673d8e2614bf03861db0c762c6753a848e30a7f4c86245a907aad5e4d2b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414599, "uuid": "057f2b88-940e-4701-ba6c-2572b5e783e9", "comment": "Malware payload", "value": "67b29c36c6dc0fcdc9981352d3e43841ef54e61e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414599, "uuid": "2ef3be92-5651-4f30-83c0-30a94bcabc0f", "comment": "Malware payload", "value": "9d66977c669436e61bdd365674aa227a957e9594335d5e76b1459a6349eb4d3e001ad65a00115098c307304bdd5f0fc4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414599, "uuid": "3e1f5a85-5a10-4836-bd20-e70acfb633b4", "value": "T1DEE423CACBE32247D11164B722F148E9477AA8F8FA4A07375AE304273BFA7654DE1184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414599, "uuid": "8534792f-f639-4292-954d-98dd6c63ad93", "value": "12288:WZa9CEIm/4WR/QdltiqNSx6mLbUjC+Vdf2QGDeQH1oH+QInNAHXNcJP0xJF:c0ieR4Yqs6w6CcdweQHyHZw4KJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414599, "uuid": "a25c431b-c80a-4299-b9dd-3dd510be8e2d", "value": 661727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414599, "uuid": "ce45ca0a-7075-45fc-888c-622f15e1c522", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414599, "uuid": "3819b2ff-b7a6-4024-9b51-b87861c7c6b3", "value": "Purchase Items.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a868e54-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691381325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381325, "uuid": "f4250dd5-1d65-43de-af03-0460050563c8", "comment": "Malware payload (Mirai)", "value": "df78e9be58a742abd03a1681935ae0fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381325, "uuid": "8c105d33-40da-4b1b-a6eb-f09b99b0933a", "comment": "Malware payload (Mirai)", "value": "3a9b1fc908ace055410936c43cbb297a8caa2b28958ab76c4f178794b7598c64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381325, "uuid": "279b6c5a-d670-45f9-8aaa-55a7a246ae7b", "comment": "Malware payload (Mirai)", "value": "893fe54595d9d66563d3806e517f036f670b73cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381325, "uuid": "89260071-fab3-4f12-b037-c8accf7dc170", "comment": "Malware payload (Mirai)", "value": "db8633995a6b2ec26af7f2f714e34bcbb695e77f54bf308e6f05f1167984a14f7e6726dc0a9507a4a53d27a892e2471d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381325, "uuid": "30167638-29bb-4159-8028-645107f1263e", "value": "T1B0E32946EB419B03C4D22B7AFADB424533239B54D3E723065928BBF43F877AA4E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381325, "uuid": "f041b742-db9e-4230-8597-d5fdd543151f", "value": "3072:2FURpN85bnZa6DTLZPQzUl+fwPFl1nqEJeFovR3VM/9H5orb:GU3NQnZaWTLZPQ6+SF/nDeFovRFM/9ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381325, "uuid": "a2bb879f-c65b-49ed-8d48-34a9eace6064", "value": 144662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381325, "uuid": "63206d58-4a66-4c14-ad29-5fefb9b9140d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381325, "uuid": "095a1ae6-e35e-4c4c-93f5-107afc1a4352", "value": "df78e9be58a742abd03a1681935ae0fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e057a03-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400283, "uuid": "d7b4e5ba-ca54-4400-a6c5-c99b25d42a79", "comment": "Malware payload (DarkCloud)", "value": "ed45c90a20815b26f952566077b8ccfd", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400283, "uuid": "45fa0bcf-fc68-434e-9ce2-a89c1fbaaa6d", "comment": "Malware payload (DarkCloud)", "value": "3c4b57db96914647ca82a603645b1396d754382ab283a7f84094589c9a5b9635", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400283, "uuid": "2541abbc-d5ec-4437-a55b-adc710db593a", "comment": "Malware payload (DarkCloud)", "value": "da94d67323c78d919770196208678d6fcfcbc98c", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400283, "uuid": "b282f9fe-03a8-458b-963f-1a369606191d", "comment": "Malware payload (DarkCloud)", "value": "13ebf12b214f47ceaddc336bbcba0c9dccb5fe3161751a43532492985111b3d82bf457a70cb5f15a614f8f4c68c43fc6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400283, "uuid": "5ad0f3cc-8b55-4c36-88ad-031bf3069e26", "value": "T121844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400283, "uuid": "4dbdac5f-b306-4336-b645-9ba958144fcb", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400283, "uuid": "8d38bea2-34c4-44c2-a91f-b92da2bfaf43", "value": "6144:Fhys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:Fhys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400283, "uuid": "cb8cee88-2157-47ed-9533-01be81c4fed4", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400283, "uuid": "3ab29faf-ce4a-45e1-8469-3a32c047218c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400283, "uuid": "ded3f77b-1067-4e01-9fc1-11ebc820c9b8", "value": "3c4b57db96914647ca82a603645b1396d754382ab283a7f84094589c9a5b9635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f03150d-3517-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691408606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408606, "uuid": "ad0a0eb1-d66f-40d5-92c9-f4d0d083d5cb", "comment": "Malware payload (AgentTesla)", "value": "96793fbb7057b0aaff5d87044e485d98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408606, "uuid": "4c410573-bfa9-4a19-bc11-eedf22d3a59d", "comment": "Malware payload (AgentTesla)", "value": "3cd93182a288f47ebdd3793de6521a3bd69b38f1d86827418b5df09f2f95e1e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408606, "uuid": "fc1205ad-c165-4eb0-8b8f-3675213fcaf5", "comment": "Malware payload (AgentTesla)", "value": "890b292a68ebd8cb42f29ac2c38d6ae021eba20a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408606, "uuid": "e68cc846-ab58-40bc-9394-cc8dea4cd70b", "comment": "Malware payload (AgentTesla)", "value": "ace00d5d783d56c2fc202a1c5472eae2d863dcf3d0891fcba7f17aecae3c69f1865ab60d339f634b0b1aa5d4b28277a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408606, "uuid": "4c131984-9128-48a2-90ca-1136498da3e6", "value": "T1E8F282037E48E716C5883E3B51EF291453B2A1C71233D60FAF8CBEA628817975D2976D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408606, "uuid": "f74f6540-116f-43cf-bfdc-53f2f67559fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408606, "uuid": "f0d61c6e-71ca-4116-a99e-8174873b311f", "value": "384:ACqM+UiXDJOtidI6USNi5vC/BfeNSqjPraZfaGqUBdxdck1EYWxPOmB4yyi4uD3k:ACYdkvzzkcThBhyiVB8BhKcaZKGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691408606, "uuid": "e7cca6d1-9e3c-4797-b01c-88ab5c7da90b", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691408606, "uuid": "0118f594-e228-44ae-9622-bee7de9daea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408606, "uuid": "6579b61a-76ce-4732-b609-c6280ae553bf", "value": "3cd93182a288f47ebdd3793de6521a3bd69b38f1d86827418b5df09f2f95e1e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bc988d-350f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691405285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405285, "uuid": "5e1eaf01-3db8-4428-bee2-dda178b1529c", "comment": "Malware payload (Formbook)", "value": "d544edf8d39f07d5088b21a68c82e4d4", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405285, "uuid": "a75def83-f4d6-414a-9314-75a7a00fa037", "comment": "Malware payload (Formbook)", "value": "3cfbe6d313af628cfb2cf9f50cd12e1da119d8b0059ad812da885f90c58147eb", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405285, "uuid": "0956c38f-bd4e-4fa0-9c5f-d3d355a7bdf3", "comment": "Malware payload (Formbook)", "value": "5bfe1ce0407cbcd07bb138ef60bc618ab088257e", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405285, "uuid": "fc814325-d9f7-4ecd-b575-777c6f22923a", "comment": "Malware payload (Formbook)", "value": "f855c22006d94516a720fed0b490c8914f5a960f38db4068e5b35d2cfda95183b96ba3438bedd250373620a819ba5b7e", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405285, "uuid": "9c5d82af-5a6b-4d97-af47-0e765866cb67", "value": "T164327D6B9E9481BDC30B13BB92E03416FBA4756BEB28120E597CEA4582722CEB311754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405285, "uuid": "c01048c5-6d3c-4006-b3c2-355dc9ecddd1", "value": "192:kya0N5lclWm4N5eNA2A+EnVs+mg1SoB3cJYkO36PvPKbwPNY9JcWezUlQU:kyX5lclWmu5+A2bkBdBMJYkOqP8wPe9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405285, "uuid": "44fe86e2-a20f-4fa9-8d13-64c9078c040c", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405285, "uuid": "f6647783-57a4-4d1c-9be9-44a4ad6cc825", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405285, "uuid": "16b65ae2-9cc0-4074-b568-103f101b6297", "value": "DEC FORM.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8718f9b2-351d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691411143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411143, "uuid": "2fe0e239-8f11-4793-9990-effdd2f0256b", "comment": "Malware payload (NetSupport)", "value": "36b6797b820baa797e6f2fb1919fab7a", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411143, "uuid": "ed5586c4-ff57-41fe-b891-4e9c4e42476a", "comment": "Malware payload (NetSupport)", "value": "3e1e55d56fd3fe188620deecde53f5b69d70b13cfee1d6e548a5d7922013d40e", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411143, "uuid": "e4d0746b-48c4-48be-ba0a-f0c43f1d249a", "comment": "Malware payload (NetSupport)", "value": "02d62c551d8e849029ea0ddd8c132660a9ccaee1", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411143, "uuid": "65385a3e-3866-4ed7-9534-4d94bfebf779", "comment": "Malware payload (NetSupport)", "value": "4371d8db1816f37eaae243fd0f8d2e033b35ca317771a7bce418a7b2a69d0b70f74ae571788b45d89e1920b7ac1247b4", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411143, "uuid": "e67acc24-dc07-4cda-a120-cd8407cb4e3b", "value": "T13645DB38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411143, "uuid": "e31da0eb-29d2-4432-a093-a2671e9a16d3", "value": "3072:+6mOV2bkmG7XUrkNyS9g6MJwjiaFeOPnSjoFAw0MxyP:+6mOVzU5S9xMi5FeOPfCMyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691411143, "uuid": "7fe6785b-82c8-4783-96c3-4b1a0fdeb2d4", "value": 1251030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691411143, "uuid": "1de0e6e7-19f3-47d5-969a-361fb81708ef", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411143, "uuid": "92420ecc-01d2-4479-a3ca-8c96595214df", "value": "fishermanx.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84693cbd-34ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691377208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377208, "uuid": "a401ccd7-49f1-4008-918f-e1789e502589", "comment": "Malware payload (Mirai)", "value": "553e9325ce9964508f132bc4ac234b40", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377208, "uuid": "8204d38d-4843-4756-8560-9c071372b82c", "comment": "Malware payload (Mirai)", "value": "3f209a751ab98eedf91921cdcaecd2580327d12c04107f958fb6d6bb77b97bd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377208, "uuid": "a09745b2-4ed8-41e6-a8ff-08c802d06fa5", "comment": "Malware payload (Mirai)", "value": "c10dd560a5186beac2e0e9e943f3baa8ab8d52c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377208, "uuid": "5cfa230a-0c00-4849-a247-ca47dafc1324", "comment": "Malware payload (Mirai)", "value": "bb94f4642ce386bab1fb3bc8d01fa7cd3e24118abeea336d5701959535c7da2b81fb6b226be23708a0c40843a2e9dba2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377208, "uuid": "0ea8b807-0a85-4b89-b82a-d248f6743959", "value": "T1CE532945BD819712C6D51177FF5F428C77170398E2EA32039E2AAF71278B9660F3B612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377208, "uuid": "deebc437-d242-45d6-853c-afd11771bd9f", "value": "1536:lGDmnTMnC5qygj5j875Cxvp8wrbOTWvkEe5YUHDv2q7:DTMnkngF0ExvpTnhQX2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691377208, "uuid": "50c548d5-4243-4513-b0fb-eb77ae4c8bc5", "value": 63940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691377208, "uuid": "f776caf7-b73e-428c-b825-189c905f27aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377208, "uuid": "57fd44c2-cf3d-440c-86cc-f9801a76d19a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbdf132-351e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BlankGrabber)", "timestamp": 1691411691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411691, "uuid": "d0bb7bde-206d-47ea-b27e-189e0781984f", "comment": "Malware payload (BlankGrabber)", "value": "49daa23846a2e5b5727ec59f9bc525c6", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411691, "uuid": "b919cdc4-44a4-445b-a5b3-6cd856d406c9", "comment": "Malware payload (BlankGrabber)", "value": "3fae6735a44f901db80b039a624ec9658ef680e3606d14867b94b56bc1b0a9f6", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411691, "uuid": "7b4a0bd8-aefc-4755-8a73-cf049adee1dd", "comment": "Malware payload (BlankGrabber)", "value": "a6f92501ac4a4a6f08c8c15b8e1a8e3c4b541158", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411691, "uuid": "2628bb61-3db4-42ab-8c54-c97442983db5", "comment": "Malware payload (BlankGrabber)", "value": "edb8287bfa3ccd57995f629d9e4f3c3feef489e67653b842b409a87e88276bb00e98ba7d233eaee8b6638177f54c944a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411691, "uuid": "d562b9ee-9710-444e-8ebc-71fd5fe0348f", "value": "T11D7633E6D6D39BA4C053CE3683C61DC09CA4A32F45FC1A4A1195B3F52A0E9DCC977B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411691, "uuid": "5078fcd7-297b-4018-93e0-ef5be2085a3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411691, "uuid": "ba8c365c-b415-4a7d-948c-36d5ca3dd327", "value": "98304:W0xxO9zR/kU28FXVfCM3p7UwXrlChJXDOTPXy1WrD9jcGjZ2zYQ2MCDaJVyb35tr:x88U/FXVbB3Xr6JzUi0mGjy2Mzybj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691411691, "uuid": "3e30d1be-671c-40f6-9e29-634b2009214e", "value": 7239168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691411691, "uuid": "a007a9c4-eabd-4a4e-a062-cfa42e9c2c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411691, "uuid": "4d960f00-6676-4d44-934f-cb371fb2bde5", "value": "spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec53b3ab-352d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691418184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691418184, "uuid": "5beeab12-24b3-434d-956f-e57dff52d198", "comment": "Malware payload (AgentTesla)", "value": "8834150bb6738dd7d34f5fc406d306da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691418184, "uuid": "35a0b1f8-386d-44f2-b21d-bd3d9a0b585d", "comment": "Malware payload (AgentTesla)", "value": "40cd96e25835eeba956645398ed73a0f0e14563375530fa5f2db3bcf44dd88d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691418184, "uuid": "95f75d70-7675-4905-8ac3-a16601c6436d", "comment": "Malware payload (AgentTesla)", "value": "1b3adc4ec8ff41614e187132e9a2b72fb31bfd0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691418184, "uuid": "c060fa1e-7bf5-4cc6-865d-db6b52161cd9", "comment": "Malware payload (AgentTesla)", "value": "35046996d542fad463f7907228904c1eaf9c13858797b1cea72c325756677d9b3d2f0a6d53abaa638bc2b87b4adee66c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691418184, "uuid": "6f650d13-0ebf-494b-8c24-50939484c898", "value": "T1F8E49E7406A6C60FE41B1B38C8F2E2B57FAD8FA096E6C3474FE47CFBB44A0556681094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691418184, "uuid": "12e2f54c-f562-4e66-a8e3-0ef0905fc3a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691418184, "uuid": "9cdab9ed-af4b-4644-a78b-6e1304a5c888", "value": "12288:NtBwpNZsaVayQCfGQtW/z+XL4E75B8j3C/:7B6L/l3gze50A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691418184, "uuid": "03d5f926-d5b7-445f-96b4-31ee412d799b", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691418184, "uuid": "b55e6523-26a4-489b-ac67-8ab0003ef099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691418184, "uuid": "e12b0a40-1527-4a1c-8fda-182a7ddb3501", "value": "8834150bb6738dd7d34f5fc406d306da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6ff3b2-34d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691378131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378131, "uuid": "8ddff5f4-1bd0-4ad0-8d39-727052646549", "comment": "Malware payload (Mirai)", "value": "f6eed68f63b4e465aa45d25c1284b726", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378131, "uuid": "f6d113d5-4fdf-46e6-8d87-20a8bdf5b28d", "comment": "Malware payload (Mirai)", "value": "40d8bdf323a963cd8eecac41e7f9ca83b7c9251eb94e96979951238f54f5da35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378131, "uuid": "863a1304-e5dc-4386-9be5-b0f8c943771e", "comment": "Malware payload (Mirai)", "value": "98cd1bdf580828cc4b9471154d01dfe0df7cffa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378131, "uuid": "e5e74980-950c-4f65-b601-0e710c4aad54", "comment": "Malware payload (Mirai)", "value": "761cb422db59af53d0e59fbfa54fa81e5aebaeffbf9baf03684fbe2c9b89e4352b63c4ccae49183f7b7bd0f1fca02ebe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378131, "uuid": "e06c7f6f-79e8-4e79-aeda-af711f05e55d", "value": "T14383E60AEB910EFBD86FCD3707A90B4635CC955723A43B7A3574C928F24A54B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378131, "uuid": "b9ae5625-ebd3-4427-bc53-671e09d75c88", "value": "1536:ZhSVwyQITh2uiFkEj3uMLoiFRxR3cj76yHsdZvELlMnYIh3aMDSwkdpqh9:TcwRITwzHdyHyWaUwkdpw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378131, "uuid": "ecdc6a65-7bb5-4f7a-9879-c523e163d16a", "value": 84984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378131, "uuid": "4c4b950c-1b5e-4393-9bd2-355c0b4a7c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378131, "uuid": "053b5e34-0bd9-4532-9bff-e2e520219842", "value": "f6eed68f63b4e465aa45d25c1284b726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b75780-34fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691396732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396732, "uuid": "d0daad6b-2049-442d-a3d6-fd857c491750", "comment": "Malware payload (RedLineStealer)", "value": "2e05358b2c35a5279467c6780ae16c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396732, "uuid": "90cd9c14-336b-4d82-9e8a-591831c264fd", "comment": "Malware payload (RedLineStealer)", "value": "41052dd1d4bceddb8765359ef8e1f319fed55ce6c427e47f7eddebaf740ac97d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396732, "uuid": "ebddcfe2-9b3e-4a95-a9eb-22e45c07b091", "comment": "Malware payload (RedLineStealer)", "value": "833537db4ed37ebdf490d4085e236333ba36ffb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396732, "uuid": "724b4f64-c3e6-4d11-948f-9579dbd00cf1", "comment": "Malware payload (RedLineStealer)", "value": "1b8c892cd51be7fb1e9c551bb2667866b766279934deec5ca5f6505538c32fea5a6c61854ac23230a9d20fd3d795104a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396732, "uuid": "494752ec-2a5a-49a2-8b5b-1a520be0282b", "value": "T18C56D01B3C84526FE13D8EF3C59E686AD785266B2430D9DD2D92130724D374A6AC2F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396732, "uuid": "c88cf5df-4907-425b-aee2-5eac4177d006", "value": "98304:9lvGIat2c2MyIfL50dC0R+1VlR88ZBgTCh1m4V/:9lvG1FyIT5lmqeT+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691396732, "uuid": "abbe39fe-6492-40ab-aefd-9fc4d22847e0", "value": 6434816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691396732, "uuid": "375c25a0-669d-47ce-b337-35c12082e19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396732, "uuid": "858554a9-23e1-4dd4-b5b0-a711f42fa07e", "value": "2e05358b2c35a5279467c6780ae16c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f78e96-34fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691397296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397296, "uuid": "a9c23b1a-494c-49eb-88e0-6cb2b03070bc", "comment": "Malware payload (DarkCloud)", "value": "656de6c12631ecdadd0e80fbc8354720", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397296, "uuid": "c019b5c5-447d-454f-b3e0-b69c49881200", "comment": "Malware payload (DarkCloud)", "value": "41f4fa1d52c4bc61d1168da65e81800f4aa06387004f9dfa9544c407a9a3db6d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397296, "uuid": "041c05d9-d0d4-46fa-a276-143bd54a79f1", "comment": "Malware payload (DarkCloud)", "value": "ba8b86d5d0dbe7e9d101fe32a512668089df1196", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397296, "uuid": "8d7232ef-8dcc-477c-ac11-27a334aeba95", "comment": "Malware payload (DarkCloud)", "value": "de3283f8d8749db8fba39c82b48dbd1dfe2203c0f616206dacf594bf89966926dc5d1f8fe9649467b0d1c468789007af", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397296, "uuid": "6d768b04-9ae6-4339-a6df-3ff4effb0bda", "value": "T1ABB4182AE660602EF093C8F0E6E562676814BD771298A817F3915F4931365F7B8F132F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397296, "uuid": "eaee6824-245e-4e23-adf2-0b3300f899ce", "value": "12288:haG88NqWx3CMj21piSU+FfUZ6DWn2jYKkJj6GmZUW:9NSTU+FfUZEuYYb6nZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691397296, "uuid": "e26222a6-6305-40c0-a4e2-483066996e0f", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691397296, "uuid": "f0439b6a-bdb3-4423-9f7b-437a376e63da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397296, "uuid": "ebc86d36-d2bc-4b7f-81f6-242717fccdb0", "value": "41f4fa1d52c4bc61d1168da65e81800f4aa06387004f9dfa9544c407a9a3db6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31548e61-3505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400691, "uuid": "246eee6b-e98f-4996-bfd7-58c793e66b05", "comment": "Malware payload (DarkCloud)", "value": "75b66d40f7c525621f898a878f1a06c4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400691, "uuid": "e5a5ac13-542c-492f-a597-0d49b54f6f3c", "comment": "Malware payload (DarkCloud)", "value": "4223ea3c03ee243f49bb7f27da0e44f3eb050bc33e036d902cf50f5ea180e8aa", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400691, "uuid": "7d572d58-df57-4931-9d24-1be0b2dfa25c", "comment": "Malware payload (DarkCloud)", "value": "605876a199b6d8b4041820de9589c56dfa5617e7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400691, "uuid": "1edabd73-3bc0-4e74-a829-42c507543d6d", "comment": "Malware payload (DarkCloud)", "value": "c0ee841a6038a784892603b45fc1a080781714e19b6e277fc627e3da290a807526938a89e3b1acdcf6ec068b630a4652", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400691, "uuid": "5a916dd4-7150-4a44-8518-59578c7e5e8b", "value": "T1C8844A12EA69703AF073C4F1AAB4922778156E362244E89BF3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400691, "uuid": "27e6b5f1-d76b-4267-aa4f-f78745c5412c", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400691, "uuid": "f507ee84-71e0-4d20-a08d-6811cf0665db", "value": "6144:khys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:khys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400691, "uuid": "b9783616-1b13-4d96-9d9d-1e6089dcd4b9", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400691, "uuid": "f67d5325-568d-4e4d-bfe6-77b12ba7497a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400691, "uuid": "46c11789-c454-431d-94b8-780d0557dfc4", "value": "4223ea3c03ee243f49bb7f27da0e44f3eb050bc33e036d902cf50f5ea180e8aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfc9cdf-3546-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691428681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691428681, "uuid": "a842f466-0c98-4db4-9915-66a89a5e658d", "comment": "Malware payload (ModiLoader)", "value": "b3d0cd570ea30e3c51e91ca19f5b9b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691428681, "uuid": "1983a487-a42f-4cbc-8f7a-e6c8d904fddb", "comment": "Malware payload (ModiLoader)", "value": "43ff884128b4cee041776015abb9692e42db2cbf8b5a4364859d346c809ec5cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691428681, "uuid": "6107cb5d-e6f4-49b1-bf74-d594e48344f6", "comment": "Malware payload (ModiLoader)", "value": "8eb7a9620f26ec9a940afad83824e1d0b6d6bd02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691428681, "uuid": "cb3828d0-ca0d-4cdc-b44c-5ce2338aa737", "comment": "Malware payload (ModiLoader)", "value": "6727dc9aba5a7fdcf29eaf506ee82b8c09f56fdf3d2440a82f78bfb3f32ea03452568c31a0bc16c3160f103770859f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691428681, "uuid": "1134a837-bac8-4d0d-9fb4-0ced727749b0", "value": "T15125BF21F5555433C6372738AD4F6AA89B2BFE301938B44626F89DDC4EFB240396B163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691428681, "uuid": "35769c8b-8fcc-466e-bf86-8ef2be8469c9", "value": "f124c2769d9b6924a548d49dbb0637ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691428681, "uuid": "c7446b98-e688-41a2-bc64-5c00b4d6b260", "value": "12288:ahC5PdEN+Ff8tsq8BFhMw3iiKu0OnPbWfLFhL7rBZYiGJNraCknCPRe7Fly:hTLFf8tsq8HhMw3AuhnPbCRZYimadE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691428681, "uuid": "0c1897b9-70ea-468c-b220-682b2a126e71", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691428681, "uuid": "635d4886-1704-4750-bf45-11a28a6402c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691428681, "uuid": "7e612cf7-4417-4e3c-8ee9-017ca31df963", "value": "43ff884128b4cee041776015abb9692e42db2cbf8b5a4364859d346c809ec5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1879a640-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691381322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381322, "uuid": "9b12ea02-0493-4099-adbe-3ee8669cb013", "comment": "Malware payload (Mirai)", "value": "86ed03b8f3cec61971c205e468038510", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381322, "uuid": "8d5a3b62-e1db-428d-8ce9-84a610a8ead6", "comment": "Malware payload (Mirai)", "value": "450e2e29cda720d568299d646cb0bd908d7a9e0e8434739f30a98976e64f49c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381322, "uuid": "6eaa460c-f59e-45db-ac9d-4c398915b219", "comment": "Malware payload (Mirai)", "value": "be6f8c1c12bfda0cc11c74f8f361c15fb658dab6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381322, "uuid": "2997214a-49a5-4474-8357-e7156492d0ce", "comment": "Malware payload (Mirai)", "value": "814836de05f744c899626021ea2db7bff8a97cf7b81370c3f2a6421413c9f5844f3c4ea994f198c2f85d2b5ea6302f20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381322, "uuid": "0286c057-c552-4899-a024-ae62a6a20988", "value": "T1BF83C74A6E318FEDF26C833587B74B20975933D627E1D684E29CD5041F6038E586FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381322, "uuid": "c9f82880-b95f-4a07-ba80-5c09b442664a", "value": "768:JfakxAuAYoRtoeC0hdeQjZr1tZSlRwjtVR9A1daOT8yFOF4kLnRPZXjM8MDauCMu:JCeANW1I1L1PpjhV1M5e3UURGQ+qNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381322, "uuid": "912e3872-481e-4bc7-8e66-e559d4da33d8", "value": 80800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381322, "uuid": "6a02401c-1875-496a-81e3-64888baa661f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381322, "uuid": "ed639933-095c-4d3d-a335-3f4653e44acf", "value": "86ed03b8f3cec61971c205e468038510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afad491b-34d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691378140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378140, "uuid": "d11072c5-ddc4-4712-a87e-94e2de12552d", "comment": "Malware payload (Mirai)", "value": "f5a55961281d9d579a6bdc9d5be9340b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378140, "uuid": "f7a2c5af-3e8d-41e3-ae85-246977a24f4d", "comment": "Malware payload (Mirai)", "value": "455f6db1604cb943cdf4a92db7dad653c95550b826cef764749a10c13bf8c462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378140, "uuid": "e60a9697-a711-4200-b029-78bba0dff4b8", "comment": "Malware payload (Mirai)", "value": "8ae6fc5b822d762df30151b7a62a6d43f792990e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378140, "uuid": "58a413e8-d2ce-4c43-bf71-7d2c59f01ba8", "comment": "Malware payload (Mirai)", "value": "b644e7c6ec3b4a25876d4e8877fa1f2d60812deb95076e9652b6343fea9a227988c90ac92f0742d6f8d0b81bd2499b2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378140, "uuid": "c8b687e4-4fcd-4938-8eba-5b206d181fb7", "value": "T1C2631956BD819B11D9C1157AFE0E118E73130B6CE3EE73225E24AF35678B86B0E3B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378140, "uuid": "78fa4e44-312e-4971-bd4b-bf1b5042c7e2", "value": "1536:EjnyIBQ7lg3p8C5XaxxsVaO5dq2mzMviHJFgNBg7Ww5AYIqy:2BQ763p8CQxxsVaOmFJFgNBgCweX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378140, "uuid": "fe6b84e5-96ca-41dc-9cbd-14177828786f", "value": 72120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378140, "uuid": "bad9a46c-9cd2-40a8-8819-a4cb3e434512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378140, "uuid": "5b567361-e5e8-4f1c-bcb6-82d6205b0234", "value": "f5a55961281d9d579a6bdc9d5be9340b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356b891e-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691390390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390390, "uuid": "4df85635-08cb-4236-a6aa-a4e8c695b156", "comment": "Malware payload (GuLoader)", "value": "60a983daeb1b374a5435e287d88983d2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390390, "uuid": "eea6e960-a45f-4366-b2d5-9ead96f51e9a", "comment": "Malware payload (GuLoader)", "value": "470057993cd8fa120b081ccb8d1b53dc7492208c9111f1e84c58c3d69ba6e9a5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390390, "uuid": "a977f507-67ca-420f-a5c6-e23cc1f6a91d", "comment": "Malware payload (GuLoader)", "value": "e13f3c2c921fbd60bc0e4f3c1ee19ef36c50d2db", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390390, "uuid": "a6840dbd-0483-4a8b-b88e-b2b69841d05a", "comment": "Malware payload (GuLoader)", "value": "929e8e1678f1b4cfd0a0fb206f22416ae0e067fc3a639e48f87711fa0ac90684ddd25f5e3c31a83d3a42e8d23a6bd228", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390390, "uuid": "75c4c7d7-8975-4c75-bb9a-81fc9c3cc52d", "value": "T13FB423488AEC798E32F933392E9050E4FD1669A0DC0FA2E5BAD23F56D591CC163CD658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390390, "uuid": "3c25bf7f-39ad-49d7-9d46-302f120cfbf3", "value": "12288:3YSuj67ZGr+hA4YqO5RtP0YA3fRnZctWBPr0Ml:3juj3BPqOpP0Ysj+oPAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390390, "uuid": "a68101e7-9f37-4ea4-b47b-5bfd15abb10f", "value": 496160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390390, "uuid": "2d00367d-d274-44ee-8401-70316d30f64c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390390, "uuid": "7686ac28-8710-453c-ada2-cab0792f1e87", "value": "PT Inquiry - Quote 09052022-008.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f04361-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691395404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395404, "uuid": "669b513c-2fe9-4ec0-afa8-0e9bb8676a30", "comment": "Malware payload (Mirai)", "value": "e437f53e8c48a9c9e27914ab3adb7b82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395404, "uuid": "b068dc97-8295-4b6c-9dc1-8f66e239f20e", "comment": "Malware payload (Mirai)", "value": "471bfce99ef20fda028d5e5e74d498c4eddd0fdeaab58fb235c26f09a8800d80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395404, "uuid": "09410398-1849-47d0-abe1-1c96a07ecc41", "comment": "Malware payload (Mirai)", "value": "24500352872d249c701541b309e5c9920d83bd8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395404, "uuid": "1eb20f06-d4f0-46fd-b7fb-a60af1238815", "comment": "Malware payload (Mirai)", "value": "df9b156eaa6e71559fe3a702abc62f139948f114115037c37fb4f4949f6a893caa02bb1a5713cd41e13b461f224d8d42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395404, "uuid": "ecafa85c-ef40-42c1-ab54-4c9f38aee36c", "value": "T11DC2D184F1419A05DFEA29F52944DAC7FBA06F1EAA618EC126A053C25B5D3734305ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395404, "uuid": "3aef35ec-b04e-44fd-9272-0ab7eebbe6e0", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7PhEz4uVcqgw09x:tam+AnKehPRa9ayz4u+qgw09x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395404, "uuid": "b7175182-3c16-47d5-b4f0-1f3471ebe53e", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395404, "uuid": "091b88ac-a5a8-4a96-8114-f8770320d5ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395404, "uuid": "c96402b2-0720-4e9a-9adb-8893a7ca6c79", "value": "e437f53e8c48a9c9e27914ab3adb7b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854cb63c-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400402, "uuid": "fea0921d-86e2-426b-9ef7-43b442c041a4", "comment": "Malware payload (DarkCloud)", "value": "034f2df8b8114b8c391c1393b271d33f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400402, "uuid": "34b3efd2-cb97-4ffa-9455-f50fd9e5d872", "comment": "Malware payload (DarkCloud)", "value": "4850dbdb83c5db03eb3dd3b8fca9500e82ec9169fccb0bac91d3b5fd9fecb83f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400402, "uuid": "aaa12f4c-2698-4abe-b6c8-9c4577f4717e", "comment": "Malware payload (DarkCloud)", "value": "ddcaf867fca5f5e8af1e0700fb0b6829bcff8337", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400402, "uuid": "4b12020e-158b-483d-8de3-ec594a201b14", "comment": "Malware payload (DarkCloud)", "value": "4e168f74eec6013ca093ff1a5f0e5841366bafe998dd984db37b8626bdce1377133e3910050c0db751b18efaa5b06706", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400402, "uuid": "51c17751-77c4-472f-b878-191ef8e25291", "value": "T1E1844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400402, "uuid": "4b6a9938-f9c6-4db5-8a49-49e80a68155c", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400402, "uuid": "bea023d5-957f-443f-9ad9-156e735f6048", "value": "6144:Rhys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:Rhys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400402, "uuid": "4e1fb57d-0519-433d-9e0e-dfbb828082f4", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400402, "uuid": "72b0f66b-80c0-4469-9285-4d944e67c2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400402, "uuid": "33f48181-8635-4d05-ad9b-d32b9c6532d3", "value": "4850dbdb83c5db03eb3dd3b8fca9500e82ec9169fccb0bac91d3b5fd9fecb83f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47050cdb-34f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1691393426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393426, "uuid": "8af54cce-dc43-4164-922e-8f48ee989aad", "comment": "Malware payload (RiseProStealer)", "value": "046ca0cee23915bf236e53d0aa03b66f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393426, "uuid": "8f85bdb9-2916-41a5-bfc5-29e24dd466fe", "comment": "Malware payload (RiseProStealer)", "value": "4875a5a5dd058961caad327b2b718e01fbf2821e4873f13b85e790a09c371209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393426, "uuid": "5341fd49-bbb6-4d89-ba4a-a6512d4c9d5c", "comment": "Malware payload (RiseProStealer)", "value": "9b56cea1c6622139ec63a33175e7db8f35e44a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393426, "uuid": "d9796d11-18ff-40d3-a3b4-3719e261ec65", "comment": "Malware payload (RiseProStealer)", "value": "62f7cf8679736bd95acc40a455fb89c3c877e561a7baa90e0911afc6dcad374e5ede1b17de0aa40064ac3f56241f0a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393426, "uuid": "b2cb15b8-b825-4a74-a042-944d253cdc4d", "value": "T1137623B87758339EC429C1B99923EC47F2B7951F22E4A59A73CB7A407B96330D702B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393426, "uuid": "25d91984-d7a7-43b1-8c7c-b130eb7e44d6", "value": "713f2679b25b10e65da54bb5dd0f93c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393426, "uuid": "1e4d04b7-1173-441e-9220-339adfdd203e", "value": "196608:QAKok6DFOo0xNRu1CeGMRQndQDIF4f/Qi:Q7J6DEo0xNO9QGDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691393426, "uuid": "4e6d7c1d-95ae-417a-ba3d-8a611d0492ef", "value": 7140544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691393426, "uuid": "01155012-1d79-4fca-8ed2-ecf460c558ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393426, "uuid": "4d345ebd-a973-451c-a66f-f64153e3419e", "value": "046ca0cee23915bf236e53d0aa03b66f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35daca7d-34f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691393827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393827, "uuid": "eb2abdb7-5faa-4499-ad06-d289a9a2ff74", "comment": "Malware payload", "value": "186cc476cbfab343637680531377ee69", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393827, "uuid": "58432254-a57a-484d-abd7-120029f27c2d", "comment": "Malware payload", "value": "4887be5d599e612866af3a6edb1628a8c46a660d24e6926f89317069fc27dbed", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393827, "uuid": "3a8ab21a-8f25-46ce-baa4-916f9876b175", "comment": "Malware payload", "value": "ab4961197901d1079c8960b1acafb6c987ea84cc", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393827, "uuid": "b3a32adc-9b7e-4059-8571-218b7102a750", "comment": "Malware payload", "value": "5d409d4aa093e04e0f2ef37cde2a34c0fee115b9806815f887bb8727cc998da897786bd47060cf5e821824156b3a020e", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393827, "uuid": "dcf7fd16-3d1d-43de-a61b-8fe6fd4666cb", "value": "T1194523D8B7AC5880D88BDB32F65D5CBBCD2C22B15D164A8C331B4E11A7D0F861E9B167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393827, "uuid": "341616c0-0bd1-4136-bc78-a43b9614560e", "value": "24576:nk1MoYCxfgYExc2H2OIr26zTt3NGMsdoYCxfgYExc2H2OIr26zTt3NGMsa:NoHfgFc2WFYdoHfgFc2WFYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691393827, "uuid": "d3e19c0f-055b-423e-8acc-608d94694116", "value": 1176852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691393827, "uuid": "7c73af90-5032-41f3-a7ad-9ac5c0f482de", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393827, "uuid": "729b190a-c58f-4ac4-80f2-583b1760b80e", "value": "Overview of Nuclear Security Threats and Risks_Certificate (EN).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91683863-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414596, "uuid": "a5731b55-6262-4699-ad19-94fde0d1d3bc", "comment": "Malware payload", "value": "bf0635f2520c4fdd43ff7796c54ad01b", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414596, "uuid": "814aaf23-5281-4525-b772-28e99425aeba", "comment": "Malware payload", "value": "4a07e5c9c360371f76dfd7baa2c322895ddd6c90a1e74dca8a5d9d15b8100683", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414596, "uuid": "3756b3b6-ba42-4b60-aff2-b36d18e05223", "comment": "Malware payload", "value": "25e490d0067cd3612e4e1f765cdf19313daae83a", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414596, "uuid": "c1ed9d94-ff23-4b11-96c0-7619db0284ba", "comment": "Malware payload", "value": "3d09fff67d618b3b14a9680a784630537d663cff9e852e00bf4c873c820e13953387fee3e3940c629ec26517c512b59e", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414596, "uuid": "5af0d42a-1fd9-46f9-80c9-cd9f4bbfc759", "value": "T18294A40AB141CB27CA5816314CCFD2F9B779FC54AF8A931B3684776E1DB3BA49A02744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414596, "uuid": "95ee0130-9765-4bba-b719-3e122b28a7c6", "value": "6144:1WlaEJznGG6uCwZW3MwnvNY9RtwGAiez9Fipg6w0WBbreX+9:1gG3uW8oGqhFik0WBbreX+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414596, "uuid": "5a6c95ca-5368-4cd1-bc13-045721a6cd99", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414596, "uuid": "e999bb4f-8693-43fc-aa0c-355e1b9f9d03", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414596, "uuid": "dea14475-a3d3-4a04-9f65-c3d014ed984d", "value": "Succesive.XLA.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16954861-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691381319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381319, "uuid": "63cc988c-101d-48e8-b1c5-616eff1ee835", "comment": "Malware payload (Mirai)", "value": "9e93fb2a866e447064b4f64ec1e1d5b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381319, "uuid": "e40e5a85-289f-499e-8238-7d01a4ecdc7f", "comment": "Malware payload (Mirai)", "value": "4b223326181a66dd7005164faaf79fc60de9c282b5ebcbc9b5a0c5b835090cb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381319, "uuid": "b7b78619-09e8-4712-a5c9-7d5cbbfd2f39", "comment": "Malware payload (Mirai)", "value": "2139672e760910199b60dbe93e74d5e0cc002c60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381319, "uuid": "279663fe-60b3-4c3a-861b-e78d5a51d1af", "comment": "Malware payload (Mirai)", "value": "6a10a204a4671bfca71d0e879871ea6df5c0769ffee0c56924ffc4a3919c25d2ce13e3f39cf41179bc7372c84e1991fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381319, "uuid": "a31a5703-31ab-4dda-b6f5-fc3e3aababea", "value": "T1CB337C87E743D4F1F84701B6607B97728371E63A5066EB82CB28F835ED12900A71B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381319, "uuid": "baa44061-35f9-4aed-a56d-020a2a8af4a9", "value": "768:qozSNwN2CQy4Y38Gs4bEzRcnADmuXtsTqXqypQIiKzvOEWIm8p48pJWL72q/+T7T:qo2NTSMpzRcADm4OdIiKD+x8LmJKN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381319, "uuid": "d23b96d2-3e8d-43a0-9250-2fce57d2effd", "value": 51060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381319, "uuid": "cd313614-ca15-46a3-b3c1-4524d0744162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381319, "uuid": "04e4f47d-f93e-483a-9406-a48818247b30", "value": "9e93fb2a866e447064b4f64ec1e1d5b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d391e37-3565-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691442023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691442023, "uuid": "964710c3-aa2d-4a42-a007-8ddfe714040b", "comment": "Malware payload (DCRat)", "value": "0323621e53ac2d912c730ad70d142794", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691442023, "uuid": "5bebf643-da8f-48b2-98a5-873d56b400b4", "comment": "Malware payload (DCRat)", "value": "4b293e302258ca0addee74cde51f231067bf75a57c98479e7f6460999ce00784", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691442023, "uuid": "8daee217-3ea1-411f-a0a9-aef496b0719e", "comment": "Malware payload (DCRat)", "value": "4bd0a8141235e2ec379c71f98e2857dfafe3d0de", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691442023, "uuid": "dd0309c0-c966-413c-8ec1-3288e86b9cd3", "comment": "Malware payload (DCRat)", "value": "5fd725caa528043ee86dda977df0f1604d0b8e16a20ff64eb25d63eb6f780b54a16c6a0bf079b700e97f8df434a42489", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691442023, "uuid": "43137dde-b35d-47c9-9170-b3c4ec282b94", "value": "T13305E5027E44CA11F0591233D2EF458887B4AD51AAA6E32B7DFA377E15523A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691442023, "uuid": "1a0767d3-f520-4181-be20-17f4b34a77fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691442023, "uuid": "babc3893-c8ff-45d8-abfb-b6cd2e45538d", "value": "12288:X3Lm/O6Qiw58mJL4mbcjp9JoZVWcpJDPwQMrr9QCUcIw1PEb:rmNQiw/JUmbqJlcpJDYQ4LUcRPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691442023, "uuid": "d039b598-e3a3-4a75-b776-6dab791fac8e", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691442023, "uuid": "c4c60518-1f40-4e15-ae40-f3aebeb6869f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691442023, "uuid": "9f319d18-6c23-4bdd-b75c-ce61b5c565c2", "value": "0323621e53ac2d912c730ad70d142794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b70ce3c-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691394775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394775, "uuid": "21aa5b7d-3539-4620-8d59-a330fd56c538", "comment": "Malware payload (AveMariaRAT)", "value": "b21779d6669de66d03dc93485c97c5b3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394775, "uuid": "04b58620-13db-45dc-a4eb-22778e3d695e", "comment": "Malware payload (AveMariaRAT)", "value": "4b3516990dcd26dc5486cd8559df55410c541412bf67c6af8bc5b2fc51dbb1d3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394775, "uuid": "75ca2df7-2e46-484d-b9e1-ddb1ccfcaa73", "comment": "Malware payload (AveMariaRAT)", "value": "894919b5fd8f7c46be0e6d12cc522e27ee0ff8cd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394775, "uuid": "2a963cca-d20c-45b1-979a-e6990bd775c9", "comment": "Malware payload (AveMariaRAT)", "value": "72be39ba78b3c0c48bd688f31cf58b2c742edada5a992186ab9c74f4504037a0761c02031265e527f6b97bf1c98a0eab", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394775, "uuid": "f56c1ba4-ba8b-4b05-858b-e0c33a7d9dfb", "value": "T18984DF1E6ED610B4D190CD74B7FAA2EE26B6635F61066BE7209902FADF0174F71020B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394775, "uuid": "620046f3-71a0-4cfd-8229-77b1607c7473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394775, "uuid": "d662ceac-c7a0-41a3-958e-599516be7df9", "value": "6144:rme7WPpL6mbNWo3lYMFa2yWrHzE19MpUFt:r1WPpL6+WoiMFaE+9MpUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394775, "uuid": "077a8ad6-3526-47ce-816d-0133606398ba", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394775, "uuid": "d9aaf54b-e658-4258-b157-f388721183ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394775, "uuid": "0954ea0b-18c5-4f3f-a167-ca1ce9589cd4", "value": "A2307330164 Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68665ed5-34fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691396059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396059, "uuid": "ebf8df3c-8f1f-4ae1-adca-22ba74f6ddb4", "comment": "Malware payload", "value": "bc45d08570b913daa6367cc116a77daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396059, "uuid": "bc2329a2-5d4b-45f6-ac0c-5a54cac8f03b", "comment": "Malware payload", "value": "4bc5386e4e27b10032228cd66ab85a3adb67412d74c267fd9372bd0be40cdf0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396059, "uuid": "01ce4a58-23a4-4076-a695-0bb13bdd3a68", "comment": "Malware payload", "value": "65bd4b8e176fd58770be6fec53d5ee512b615400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396059, "uuid": "df59568d-d034-4a01-b002-b60f14670c20", "comment": "Malware payload", "value": "5a7863c68fdd62f0efcc7a8af9a264ae0495d1c48ff6be64adb06ac8d2d0a93232ef978585cb241389c97a12d415b9b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396059, "uuid": "41dccacd-fdb6-476b-be52-a190e09bb21e", "value": "T16F84129273C74B00CD2524BD44EF823A07E16FC369378AD9BF0C36AD5E16A139F96946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396059, "uuid": "104bea54-283d-4c62-a5c5-66930591db93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396059, "uuid": "999c9d5d-0f6a-42c4-be55-a260e9319228", "value": "6144:1iyrlK2EmkseqwA1Lxl6dONR8NQLkNNL66hUMK/W3dDUyhU2rV:kyrlK0np1l/g+LkNJDhUp/WtIVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691396059, "uuid": "20121169-52a2-4f5e-bff6-66601909b8eb", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691396059, "uuid": "11458b7d-6cd5-48fb-b0fa-fe3b435cbcf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396059, "uuid": "93889f7b-e065-4086-b4c2-eb7a72106cc9", "value": "4bc5386e4e27b10032228cd66ab85a3adb67412d74c267fd9372bd0be40cdf0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ff9d8c-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691395377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395377, "uuid": "8b19af39-4fc7-4bdf-a476-a2055d16f840", "comment": "Malware payload (Mirai)", "value": "9d18361c9a5e51eae2047eb22740e353", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395377, "uuid": "16295f75-95e0-4df2-98b0-2eb03063bccb", "comment": "Malware payload (Mirai)", "value": "4c805e252930e7c2348b904bad9d50701aa562333600963967d80698437ccee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395377, "uuid": "847cac50-2b4d-4180-864d-b143eacf6e2a", "comment": "Malware payload (Mirai)", "value": "3720882d25da28669a28251856a8d7081af0b342", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395377, "uuid": "29247354-0830-4120-ada4-f591be12c818", "comment": "Malware payload (Mirai)", "value": "da8a33aca500dbe4bf16b0d64b92849a08ad86a40b1b19bf0fe131d66a7c82ce5246cf511500d4b4b57a0474ddeca9bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395377, "uuid": "c9eae520-3e8b-492b-bc4e-f6dfd3965e5a", "value": "T17ED2E09976D763E78CC9C9BEB20F402A309A34A977B29363B305D453077A181E651E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395377, "uuid": "08e4be5a-7c26-4d3d-a88f-90e3c7c7718e", "value": "384:MPd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKv59FfNyu:0lxKd29WcxEns+V6IHE4RlY990Gnqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395377, "uuid": "cb974c45-0fbd-4fc8-80be-25e0bba09ea2", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395377, "uuid": "d1321fd3-2ade-4795-bf7c-84af1d6b8259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395377, "uuid": "896189fd-07a3-4b6e-8b19-73337670b7bd", "value": "9d18361c9a5e51eae2047eb22740e353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a584bb2-34f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691393056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393056, "uuid": "1f3fb082-960d-47a8-9498-c070c8f44a40", "comment": "Malware payload", "value": "48a672ef1eb0e86ab3b250678288531a", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393056, "uuid": "fa6a0c4c-d9d1-4fd1-9aad-1d479c5ae816", "comment": "Malware payload", "value": "4dbf69b99981bc92ae560ff79ab814be8f7a9ab13df2c4eee893b15f55077062", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393056, "uuid": "bbbc422b-a292-49b6-9b06-a78a1aedde42", "comment": "Malware payload", "value": "73edc9ab3aaea605cd47b6525b5f1072b9d2a37c", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393056, "uuid": "d4cb8b8c-ecd6-4bbb-a9cd-d66e0b1d7cba", "comment": "Malware payload", "value": "521182f42543efa42e0faba43f8342cf5939824ac7f744b6423fc719cccd0e7a88e46a06738c1de14d231be7e63c0195", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393056, "uuid": "e4c92403-94ce-4953-85b3-181c8170a439", "value": "T1BD01DD02268FBCAE1667F2D23A3801902BE35040F0483A32AA801C1F5E72C2685DE994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393056, "uuid": "5ff72ea8-2a1e-4f28-bcf0-aee80f5a7bde", "value": "12:MrxS2hz7YU+Sj8ZGSGpTplnxOZ7+DP981E7GXoKIDWsC3CYnmSu661Ra:MI2hzEPI8ZaptlnxOoG1fXtIDvC1J0Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691393056, "uuid": "302ba230-5bd8-4925-8fa6-b4b3ed20afdf", "value": 665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691393056, "uuid": "7d89f3b6-0545-4957-ad82-c3493178c368", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393056, "uuid": "45b0a779-4a25-4ddc-a5a9-9fda68efa300", "value": "Client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd86a0c-34fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691397115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397115, "uuid": "9be8b2a6-d22d-48e6-ad0f-8a79234c4f86", "comment": "Malware payload (DarkCloud)", "value": "e1905cc7d48ee8b0f458cf704ee5ce2d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397115, "uuid": "31f08d24-34ea-40ac-be5f-afef3b54c203", "comment": "Malware payload (DarkCloud)", "value": "4dceabe3205184358a8d09a128e9e4b3f45d93757cf7511ba23a01ede41c0dbd", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397115, "uuid": "5dccb235-223b-422d-911c-307ae17fc152", "comment": "Malware payload (DarkCloud)", "value": "a2a14b06ca76bf4654e21eed71c63c05fb37b4dc", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397115, "uuid": "7ce48df5-fe01-4787-9da5-52c29539f2f1", "comment": "Malware payload (DarkCloud)", "value": "bc46de2dd9dd9fe06737e077f8268823cf3c172d49f74f06973e553cf815f126167d80ee42d88f0283a0f45f1221a7ef", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397115, "uuid": "5f858857-9ffe-4de7-8c1f-df373128af47", "value": "T133A45D26EB61602EF063C8F0F5E5925768996D7A12A8AC27F7815F0935311D3E8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397115, "uuid": "9f3b2b3b-f7b3-42c3-bb36-2a565bf4ae3b", "value": "1bda00bd756d4ff86cecf1c4d4088488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397115, "uuid": "37005ac9-b628-4107-a86d-b66a47c5a03b", "value": "12288:oVGVbzVTvd5/8xmIaCMBUt8ztJ0oKQiSjYKkJj6GmZU:5dViuztJ0oNxYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691397115, "uuid": "e6d20c2e-1f4b-4ca9-afe1-27d3fee83d7e", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691397115, "uuid": "50a0dd75-4249-4290-bda0-f9983699f099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397115, "uuid": "71970853-5506-423a-bdbb-4b8752320cf0", "value": "4dceabe3205184358a8d09a128e9e4b3f45d93757cf7511ba23a01ede41c0dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18708c0a-34f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691393348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393348, "uuid": "714f9a06-b08c-4b74-874b-bac84c63ef1b", "comment": "Malware payload", "value": "91cc57fa48ce2c2a5611acc24b1f8788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393348, "uuid": "3b2583e8-7bd2-4e9a-81dd-23ec60fbc4b6", "comment": "Malware payload", "value": "4e8ebddc25060eed192daa8bd7671a5dd6fd5c481f39a5db91533bfda71fd1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393348, "uuid": "4975fdf8-aca5-442b-8962-1acd45142210", "comment": "Malware payload", "value": "24057e19c6a24d43d6ff0acc1e99b7a465f06aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691393348, "uuid": "7f7a424d-d065-481e-adae-e4bba8059952", "comment": "Malware payload", "value": "f693655ef36e7b1868bd6aa1b8916ddbb05658d071a738e09cbfeb34742bd5028ed59f8a7f9a4071e294fd86689c99f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393348, "uuid": "7b5acf1d-a5fe-4891-abc9-84f37e5f4042", "value": "T1B8C353E87F9836EB847DF825E0810257A528947B24450F5FC58382CFF31669B6AD70EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393348, "uuid": "346ea721-f670-427d-a030-11b1bf1e3c9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393348, "uuid": "f2c5fbf8-d4c3-46a9-8f42-1eaec9958b6e", "value": "768:mNOuw2cDFVmXwmgDWNUS3Tio8KjOgOfdCw63kf7+0vn3wGYz54Gc2S7XThxQc2/W:m4tzOHz8EiJRnAF5cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691393348, "uuid": "4e154c00-4c49-490e-b1fe-cbc83adf0bab", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691393348, "uuid": "f2757478-7287-4821-a7a5-f629de231f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691393348, "uuid": "f33e7e94-5798-4716-901c-38e599ab8d31", "value": "vt_4e8ebddc25060eed192daa8bd7671a5dd6fd5c481f39a5db91533bfda71fd1a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acb600a-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691390479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390479, "uuid": "2bbadda5-37c5-4d12-8c2a-f715f0ea3e18", "comment": "Malware payload (AgentTesla)", "value": "80b9bbec5d0651695a48684b4e35c395", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390479, "uuid": "43917b33-6de9-49b9-a047-b34c8109d25e", "comment": "Malware payload (AgentTesla)", "value": "5244fa4cd53ba538933055ee4b4bec7f9579905c61868aac1bead60f773c3108", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390479, "uuid": "09a2d3c6-a4a7-4de7-b8ac-6c6a14e2d588", "comment": "Malware payload (AgentTesla)", "value": "811a12f7fd96a48400194b4e80525a555283dc58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390479, "uuid": "4779ccf8-cefe-4ecf-a9e4-923387783398", "comment": "Malware payload (AgentTesla)", "value": "c2e3afbea3016be95ad274eb1ddfe8787e20f5c9b977d6b8a587e76ab2d0efa711dcc267c173fcf63dacb9a3864002fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390479, "uuid": "451bb79b-6d93-45df-92b9-5f0737d48f82", "value": "T12754125011F8C0A7DAE24632493BCA27EEF0AD65B771130A7BB4BA1D7C76911EA0F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390479, "uuid": "f4b9d436-7086-49e9-82fe-1d2d65748845", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390479, "uuid": "198a45c5-3b02-4c1b-8112-b164df407b53", "value": "6144:/Ya6srMpL6griQQrTO+VVCq2Q0QLxg1tcWFNuP03CdZmj:/YKrMpDrijh/Z0QLgcWFQPPmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390479, "uuid": "394ffdb4-6167-4b58-ba91-67082812df0b", "value": 294231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390479, "uuid": "c7aa36a2-fff8-431e-af43-ecf1b0e68414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390479, "uuid": "8e295de0-a74b-4b9f-960c-3a47343117be", "value": "order 4500384851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e3f3ab-350e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Generic)", "timestamp": 1691404571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404571, "uuid": "27bb0f55-dce5-430a-aa5d-d6dcf88a046f", "comment": "Malware payload (Adware.Generic)", "value": "daa4394f0cbf5145c7e8c03e7fd87b02", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404571, "uuid": "078706be-9d32-4b19-bedc-12f8d8f6fe05", "comment": "Malware payload (Adware.Generic)", "value": "5377fdf4a8c5b2de8f21a23a0770fbc497d3ba1ff58d50d1ec952216e84a3c4f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404571, "uuid": "bd8aaf28-6a47-406c-8698-a8a5bc5a9807", "comment": "Malware payload (Adware.Generic)", "value": "aeb03943ce5274832cb00ec56703108ceeaf4c02", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404571, "uuid": "7d55cf61-8408-42d0-84a6-c20714dd3c1c", "comment": "Malware payload (Adware.Generic)", "value": "68082a1ffee11e70652e917d0faffd000d85feed307f41fc1bd69623186665f724239d2c9cb76a212480cd552959e91c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404571, "uuid": "5147bdef-a6e0-49a1-b653-4f86cebf34bf", "value": "T121C6232FF298A53EC42D563045B386509ABBBA62B8178C0E47FC394CDF325B11D3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404571, "uuid": "423a9561-8f0d-4466-90ad-7fac2efb1e33", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404571, "uuid": "63657212-1c03-476b-b26c-211e3f2749ca", "value": "196608:dwjsCRr3bEztMc0foz7r8YSMLYjsCRr3bEztac0foz7r8YSMLYjsCRr3bEztac0O:rCd3bqSc0m8KCd3bqEc0m8KCd3bqEc0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691404571, "uuid": "dc80b9b7-829d-4e24-bbaa-bb9d97c02184", "value": 12144523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691404571, "uuid": "03f7d890-6b75-48b6-beca-9224ab5f010b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404571, "uuid": "1cb143b1-9b15-4300-abf1-bdf3c8fb4de8", "value": "Microsoft Windows and Office ISO Downol 8.15 + Crack 2019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76b3036-356b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691444725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444725, "uuid": "5395074d-c0f4-4c1b-8f1a-3d3c771cc3a3", "comment": "Malware payload (AsyncRAT)", "value": "1a4366699c48a02df07c20bbaaa52cf3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444725, "uuid": "4e703a3c-bc00-4672-a697-d126c8832118", "comment": "Malware payload (AsyncRAT)", "value": "53f4fd902e35def1c2bf400b5b5be78a9915f7f80319a5ca2e01eb728dca4739", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444725, "uuid": "4e47bfcc-0f62-4ae8-9251-4350c76773ba", "comment": "Malware payload (AsyncRAT)", "value": "7b33c126376835985af1cc58c6bf2f7db6620a1f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444725, "uuid": "807fca30-abc7-4251-adf8-7e99914abdaf", "comment": "Malware payload (AsyncRAT)", "value": "e042dbe821a0b5e5b0ec9448cfbe1df1594cbc8cbf2aa98b02ece54adcbee269cb8f2c1dcf0c39a6e15240653aa752d5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444725, "uuid": "4829ff84-081f-4e13-b781-e51f8c2e2542", "value": "T195F48C6FAD21B67EC3B425BF4909B10A599E4D1243F9E447B40EF618AF3AD121F4E309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444725, "uuid": "270d3888-5270-442c-b0eb-becacbf1c61f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444725, "uuid": "bd149636-e67a-4367-8caa-4b41d1140627", "value": "6144:rrVAN4YPx8qbssRQPatntAG35AKwVjWFP2NVpLSLZQLLLLLcLLLYLLLL6LLLiZLk:vhY8qbsM6qqVz920lZS5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691444725, "uuid": "792dd9c5-de56-488a-8fbd-68081133a90d", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691444725, "uuid": "8e76e5b4-9d8d-4f6b-a664-20ff60a74138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444725, "uuid": "23791eb4-e902-48a6-86e6-da62e2349dc2", "value": "1a4366699c48a02df07c20bbaaa52cf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b232becb-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691414651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414651, "uuid": "71f0af61-6e05-4ec0-b90a-dc22f399520f", "comment": "Malware payload (Formbook)", "value": "c27949caf437e80a2db967b50d8034bc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414651, "uuid": "d8b4d038-f877-4f3d-a8dd-acba194b9082", "comment": "Malware payload (Formbook)", "value": "54e7b547ba8d52554130ac6c7d094e3a56991d79e6611aa9599e28cfd01e1ae5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414651, "uuid": "efba6905-c5d1-4db7-a98e-a6dccefecf5d", "comment": "Malware payload (Formbook)", "value": "540170f4ca961dd880f5e42d483773ff3bd0891b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414651, "uuid": "f0e99724-487b-4412-b977-ee7d18ab09db", "comment": "Malware payload (Formbook)", "value": "9085ef0188699d35470d5cc5962b92e70c99d9c1e5115982384a7f3573b30362c2f12b345d7099a3cb2b9c7bed92c946", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414651, "uuid": "9c9f23ee-f9b8-47a6-b681-f84036a12365", "value": "T1BD82CB19B5C26D34A3370A71AA0F40DEE6B040636C1745D4BA0CF3D11F3E9ADA7A7E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414651, "uuid": "f4e551ae-50da-4e30-9618-77114f28f3ab", "value": "192:TcXr0FMJfSkOl1/+m/5/e+6MJpd4T6MOrH/1Yf2D6z2RP0ShcGqTDMIVU7PaM//J:qr0omdja4RPrhJh6I0nxumA/br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414651, "uuid": "3e8516b7-1b70-4c68-99e1-b0eb2c9767de", "value": 18009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414651, "uuid": "13e8b076-901f-4458-8669-05d95f486092", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414651, "uuid": "b6a8f646-26fd-41e4-92b5-5666aabc6aa2", "value": "[DURAE] Sample Order (2KG).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f110b9-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691381313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381313, "uuid": "ec8f59d3-164b-4a13-adcd-19197894d317", "comment": "Malware payload", "value": "3eb8e0156fb1051ea2ead1a3c5c75e0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381313, "uuid": "9ba0a754-0187-4511-be6b-c17c0e2fc8d8", "comment": "Malware payload", "value": "54f23bea4629fb06a5e2068d5f5b66137e3aea5ee18a626acd016830196cdf96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381313, "uuid": "c4e1870f-98db-4ee0-adcd-d316658aab3b", "comment": "Malware payload", "value": "48743c5fe7031a07b1ff8c7109d0017e44d2e2c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381313, "uuid": "1eeea29e-69e6-4b2f-8205-77d7b773d070", "comment": "Malware payload", "value": "98fa365f1599031e8b27dc4b76afc56de84f3f8159bbfd9bd05336a93f74917ca9a194239fdbd3867233c8c38e041326", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381313, "uuid": "339d8212-081a-40f7-b929-e477ea6f35bb", "value": "T15F83F70AEF510EFBD82FCE3706B9074635CC955B12A43B7A3574C928F65A14B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381313, "uuid": "d4002630-5b0b-43be-ace0-accfada0183d", "value": "1536:hHeaYpqJVUKIgYMF0GsH4Q/M3w1Z5sZ1KadgyYSYMvfMi8SwwPq8:1hYp6yYyVs6cfwwPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381313, "uuid": "ae32d90e-ba47-4db9-9a5b-ae226ea9ec64", "value": 80800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381313, "uuid": "2597fcec-fa5d-4d6b-be8d-217e052591ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381313, "uuid": "31a20eea-c12c-4a60-9819-5e76b90c0c0f", "value": "3eb8e0156fb1051ea2ead1a3c5c75e0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94f4d90-3506-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691401402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401402, "uuid": "c44ceeb6-4a0f-4a5b-9ca6-12012ce3b258", "comment": "Malware payload (DarkCloud)", "value": "64e7f618049ca48504846eb5a5128c96", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401402, "uuid": "f6065275-df4b-447a-a9bc-3f646bd5c608", "comment": "Malware payload (DarkCloud)", "value": "5561ef2db9455c66d9fdc6b19a86e95dbef913fddd49eceded823daad8a18409", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401402, "uuid": "99b5ee9e-6494-406e-954a-346780e5d322", "comment": "Malware payload (DarkCloud)", "value": "88bee492645b4672de6b703adcde330cb7b4c55d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401402, "uuid": "503cb526-60ca-4abc-ae22-9bd51a32659d", "comment": "Malware payload (DarkCloud)", "value": "0d2df43ee2fd5bd07ac8ab3e29181a0d0225c2925aaf468057e252bed946e77399973ada0dfa686ddc7d39dd727e4943", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401402, "uuid": "f02824b2-0df2-4a5b-a882-c62ff8453384", "value": "T1AE844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401402, "uuid": "e7f73048-69e4-4738-bd77-92b2a3bef81d", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401402, "uuid": "474a44c9-6bd9-41ab-964b-c5a2c3fb8312", "value": "6144:Uhys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:Uhys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691401402, "uuid": "f0e49c81-5f91-4c84-b538-17e4d87ed425", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691401402, "uuid": "4bcc2e5f-e6ff-4246-ac0e-296f62db8232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401402, "uuid": "d6ab90d3-f0e8-45f1-be44-a2ef36d03c1a", "value": "5561ef2db9455c66d9fdc6b19a86e95dbef913fddd49eceded823daad8a18409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90666bb-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691390611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390611, "uuid": "e3f88428-daad-427e-9ac6-d357572a54ad", "comment": "Malware payload (AgentTesla)", "value": "c0d89223152b5950bd09936797135a1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390611, "uuid": "e5d2ae15-a4bf-47f1-9076-329252904c61", "comment": "Malware payload (AgentTesla)", "value": "56262526e4be76814245c822a6b521dbde2c5d3299f0db4bb2bc7b8fdee1e8b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390611, "uuid": "3eb7ecbe-fc86-41b5-855e-e62e446a2d1e", "comment": "Malware payload (AgentTesla)", "value": "4e3d04b2f10da1960710b5ecd832357c714c56f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390611, "uuid": "02755c4a-359e-4004-a791-f0fcb21ed909", "comment": "Malware payload (AgentTesla)", "value": "fbf123fe4bf582ee0e68b93685493e8140705b61dea6459ea86f69312abb3d3d6f02c5537d61fc2130c5862af6a8f91d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390611, "uuid": "b0f4c39c-51b5-4a1d-b2c1-8fd950ba6346", "value": "T1B8E4239930545F3BF53983F958D3E73257B5A82B2522D3288DFA56FA2432F8204D0E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390611, "uuid": "3d6f5c68-26d2-4c76-acd6-920ba4089ff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390611, "uuid": "27810f7a-c25f-4ceb-a265-02c4ed64b6a8", "value": "12288:/+1yYQvjOQayZEc1aqvnVnufbxNhxdrY05XX1duC/ZfcZzPy:/+1AOmEeBnVu3NrVHyYJcdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390611, "uuid": "826c6589-31df-4e20-9fdd-5902479831e9", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390611, "uuid": "8eb93ba2-4352-4932-b8b3-6a8741474720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390611, "uuid": "1ce168b0-8207-4582-994d-deaae5091d9c", "value": "\u53d1\u7968 5200549353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0617ceb7-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691394605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394605, "uuid": "aa3f3872-824e-4e27-8fc4-6dac63b19476", "comment": "Malware payload (Mirai)", "value": "85a4076a4b55ab52f7bffadac86aa342", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394605, "uuid": "effd0b33-bfaa-435d-86af-c403f8e50649", "comment": "Malware payload (Mirai)", "value": "56cb36b7bf1488599821337aceca5ffab2bf20061a2837dc77bab4df9941c9b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394605, "uuid": "203005c7-ca96-4b06-a1aa-4f8b406ce9b3", "comment": "Malware payload (Mirai)", "value": "b4e2f45a501d95c6eb60e81e78ba9a7620119e48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394605, "uuid": "6196571f-eb1b-4bfd-b724-610d0cf599f2", "comment": "Malware payload (Mirai)", "value": "b779d4a08cd4b2301c98397044aaf045221cd69575e900c33747b4fee1546576fa923173b50486dbf41e4b59fb8260a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394605, "uuid": "c1e9be21-f37f-4ef3-8dc6-5bce9c1982cc", "value": "T1F633F1625B6E29E291B05777FC33AC1A66DC17F85CA730DA3CE0A61577C58024EF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394605, "uuid": "c93f7c21-63cc-4d08-8680-73252f76a6b4", "value": "1536:j9O/ZMAXIxNUk0tLcPqF1aBexo4opKZbi:j9O/ZNKyhLGqFUFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394605, "uuid": "da8c2405-b710-4fe0-ae25-4fdb1bf3ab48", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394605, "uuid": "9891871e-f434-4432-adab-72233b01ce58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394605, "uuid": "7283ec18-8c4c-4dee-aaf1-6ddddbe40faf", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8447b3a9-3518-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691408990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408990, "uuid": "c97aaeed-00f2-4637-b69a-da9073df1c2c", "comment": "Malware payload", "value": "79cb5ee39c1cc26fd144f34c7c666c7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408990, "uuid": "c239a8ad-145d-4c06-bb98-4a077b82ebbc", "comment": "Malware payload", "value": "57183b0c9c5dfa77e5de2f598edc60fa69e5536d652ec0406ae3ddba9b7d93c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408990, "uuid": "e1dd42dc-b79e-4309-ac23-f82b86b95262", "comment": "Malware payload", "value": "a2ec0a8f9b56c03bffdeda62c7662f1cbdcace76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408990, "uuid": "794bfc92-f122-457c-97e4-1e48b318c398", "comment": "Malware payload", "value": "d68e1c5297cdc0166903c284949aa0a56b7188e3f98055e30a9a4659675ce94314d15c12747fa462edc00de9ce5de59f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408990, "uuid": "43223700-ecb3-45cd-aced-5ea57f577566", "value": "T1EBD47B88321472EFC8D7E679EA681D65A750B8F7930F0243A15709AC5E1D5ABCE34CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408990, "uuid": "837216b4-77bd-4f86-ac17-2d88aae29c6f", "value": "12288:PDe+yOqUSfICUqoh9pBJ6M+FKp9KhLpMJJ9DhGwUIVet+kERyiJjQdebxSPw:i+TofIC3KBgM+MpimTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691408990, "uuid": "ba032554-d3b4-4d84-83ed-d4024a9a66cd", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691408990, "uuid": "b79254b2-422f-4e3d-9b0b-98265210fde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408990, "uuid": "7795998b-4005-4769-9778-1dbb2f171039", "value": "57183b0c9c5dfa77e5de2f598edc60fa69e5536d652ec0406ae3ddba9b7d93c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd7cc44-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691414669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414669, "uuid": "47218823-139c-4782-9910-c2ab997ff869", "comment": "Malware payload (RemcosRAT)", "value": "ffc20e04b8ac8a8b226dd1d75ad82e48", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414669, "uuid": "d641ce05-49d3-445d-9e1c-8d49009f6c43", "comment": "Malware payload (RemcosRAT)", "value": "57a2b2464ddc1fda65db80b102f174c3a52219334491dc6957e1e4489d623623", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414669, "uuid": "582c05ef-a919-43d5-9731-06ef73e0a460", "comment": "Malware payload (RemcosRAT)", "value": "1f9c081719a65dd469bb6c462f99a9b7022b06a4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414669, "uuid": "82531827-1ba8-4333-955d-4dcb47ec03f0", "comment": "Malware payload (RemcosRAT)", "value": "388479e4031e469fa78f8691e8c042e9b60bb5dc4b8f794253162734df34f0523ca98d4f49359e79da77f319480e1ba5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414669, "uuid": "6e41e7a5-daa7-4419-a2cb-62127176a8b8", "value": "T108726CD4DDC2023505D616A6DCDB34B4B17D4CEA753083BEA858F2683BF2709AE7E04A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414669, "uuid": "af302afa-384b-444f-8dfa-3749aaf3b859", "value": "384:uMerr/W748iRJrHrxynFe5dy8cKTmbcdGHgJ/GO06PnT:uvrKcae5df7bdGHPO06fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414669, "uuid": "f00ea359-639b-4445-8754-1a28e1df4116", "value": 16620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414669, "uuid": "42c6e40e-6494-4e72-8120-d107b4bf3d18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414669, "uuid": "ba3118d0-5086-466d-b378-5916048fd579", "value": "StatementofAccount_0507202307082023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c805d386-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400514, "uuid": "c79555af-704e-4c2a-b339-d4c4f668f3b4", "comment": "Malware payload (DarkCloud)", "value": "3daed08336b1b2bfba2efa043be3bf0b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400514, "uuid": "5142696c-260b-4e5b-81b1-f22ee74e8e3f", "comment": "Malware payload (DarkCloud)", "value": "57d099db06fe73ea759b399b8f6cd77ab83cd888452afc5c4c9f69c321df44d7", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400514, "uuid": "c2f6432b-e6d6-4c95-9234-9d30d8f27c26", "comment": "Malware payload (DarkCloud)", "value": "5cc0706315ad2a2f8f9acb51097664ffd72fbc5a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400514, "uuid": "504959c3-5d9a-4c2c-9a75-0477caec96c6", "comment": "Malware payload (DarkCloud)", "value": "9ed64cec345b6a2816e91b15998e22a02d2d3c682a7f17e38d43c8745d263f3d49e1e40fd76464cc4e39094882aca4bd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400514, "uuid": "9b987978-72ae-4a72-8ea0-04d0a5a6b783", "value": "T157844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400514, "uuid": "1abe2ff1-e395-4cfa-8453-f2bd8e01b047", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400514, "uuid": "c171be41-b000-4ad3-abf3-9d2ab4f34839", "value": "6144:jhys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:jhys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400514, "uuid": "11f76278-37fe-499e-8c0b-1bf87369a35c", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400514, "uuid": "ecec1c04-cd2d-4668-8ff7-4b563d853a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400514, "uuid": "66294e9a-ba75-4d50-a7f4-6385f4cbbb49", "value": "57d099db06fe73ea759b399b8f6cd77ab83cd888452afc5c4c9f69c321df44d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6faa9d-3510-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691405726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405726, "uuid": "6b0870f5-be26-4997-9a43-8bffed62231d", "comment": "Malware payload (AveMariaRAT)", "value": "61ccfa7e637e69441e9f9dc471f184cf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405726, "uuid": "0bdee6e3-7c18-457a-ad1d-dc7e19554328", "comment": "Malware payload (AveMariaRAT)", "value": "57d2d440a40f5535bd0919d0096899b344451b2a41394fcc581d19dd62f1fee0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405726, "uuid": "9bc61bba-b9c3-463a-a4e6-a48cc14bdb86", "comment": "Malware payload (AveMariaRAT)", "value": "bdcfb6eae2166f6d154ec66e7a4fc7240d517267", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405726, "uuid": "9e0f486b-de58-4a9a-84fb-0483b6bf7120", "comment": "Malware payload (AveMariaRAT)", "value": "4ae5f52f02747ca82874821fc672ee457786e928115c15f9499c81505ee52f4302aefa3fbe5191943a8fb23d970d2f3c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405726, "uuid": "594cf290-3e97-4e19-bdee-57782c80cead", "value": "T1F4245BFDA1C02F4BD8D884B418736AC565A4C9A3305CC23F2FEBF52A5E2668519E717C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405726, "uuid": "8a44f9b0-5265-4e5b-ae07-49127a5b0b7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405726, "uuid": "c5bdcbfb-d39c-4e91-9239-965dd2a99efc", "value": "6144:h0Af8O9N159lfbouG4WQCbCYcHmFTaGF3tUM4:hKktljM4rICYcHqaGPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405726, "uuid": "643b51e4-0867-4693-a551-44d507a50416", "value": 223664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405726, "uuid": "53226049-2a3b-45c2-b96d-fc17fd595ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405726, "uuid": "24a6e3c5-5acd-4b0e-a418-bf3d1c56cb18", "value": "57d2d440a40f5535bd0919d0096899b344451b2a41394fcc581d19dd62f1fee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a018e0-3526-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414890, "uuid": "d679444f-b98e-40d5-9d64-40f6336c914e", "comment": "Malware payload", "value": "2fba85e7e1357d792e20a89b3abf2795", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414890, "uuid": "7f82e8e3-05eb-4300-a2b9-ce11125b9d23", "comment": "Malware payload", "value": "5aec8e75d09ffd3f97aadd75a571d81b1f464d6a6e0021cb102133795988f5ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414890, "uuid": "b50762b9-3375-4834-998e-5c4f223e2286", "comment": "Malware payload", "value": "5015d21c4517d214b4b6b2733d7ecff6dd767ef5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414890, "uuid": "853f8ead-c72a-43da-b40b-47539e3085b3", "comment": "Malware payload", "value": "7a75c2a9cebefba495fd3b379a85006cf7e9243052a288902975e961dd65b08ca8c230e89435ac568529409986df2e09", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414890, "uuid": "06a6bf9a-7a8a-4beb-bd26-bd85636670b6", "value": "T195323AB26FDF14D9FF4E4EF80CF34C2916A07161125223A827AC99560E65B87FC5B2D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414890, "uuid": "d02cf73b-0449-483a-bab9-9f9fbc3c72a0", "value": "ef426f15136c05e55b613bc027fab15a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414890, "uuid": "e9932633-1b6b-4251-9826-9827463f0b8b", "value": "192:IXQtwDizKFsf32i7rC1V8Qm6zF1wTksw:mww2Kk32M+1V8tsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414890, "uuid": "06c43c4c-106b-4a07-b239-b66c903ae7b2", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414890, "uuid": "313d5bd2-4058-4453-982b-20b42e77ed50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414890, "uuid": "e62f39ce-a8c4-4b6e-bc9a-bca3d7a1b97e", "value": "SecuriteInfo.com.Win32.PWSX-gen.6733.23703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d88041-351b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1691410203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410203, "uuid": "b9289a7a-0913-4a35-be95-d2460efce5b3", "comment": "Malware payload (PureCrypter)", "value": "e21c81a20456b07dd2f8c68d35b9e786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410203, "uuid": "c529b39e-4d4d-4ff6-b22e-351598163ede", "comment": "Malware payload (PureCrypter)", "value": "5b7fff06560c607aa96cb59870b1a39e911f5dc52f2c6e720e6758c7855b89fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410203, "uuid": "138cc722-cb1f-49ab-8275-fe7c06007363", "comment": "Malware payload (PureCrypter)", "value": "06a926909b0adf4cde6f1c8f0006191b64bf66cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410203, "uuid": "95119db7-9c7b-46f0-96dd-462ff20c9c5e", "comment": "Malware payload (PureCrypter)", "value": "a0c325871003d4c53e38897368c3eb9923de529c93170cda29d8ce39320d1f842a76116c1c6cc320d9b3223167645043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410203, "uuid": "74d53fd2-d07f-472f-9178-8cf28009f184", "value": "T15022061A73E8C332C67E0FB69CB2670007B5EA509826EF6E2CD5500F5EA33118652F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410203, "uuid": "b02fc577-81a8-4354-9274-7519ca4f9a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410203, "uuid": "0a33bc74-3942-44bd-8763-f9ee29223504", "value": "192:0pqSE9KY8vyVxT/9P+bi9q0f6KS1UZb8Tfy3Agd:0US68vqwbmq0f6m4fDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691410203, "uuid": "2fa71f98-dc2c-4004-b041-a0599bc1d43e", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691410203, "uuid": "0eda1c50-8fd5-4dd9-818c-960e15310ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410203, "uuid": "008e0428-3132-4cc8-8a42-53e2812e3f14", "value": "5b7fff06560c607aa96cb59870b1a39e911f5dc52f2c6e720e6758c7855b89fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae98d22e-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392741, "uuid": "26a22521-4222-4dbd-9f43-5fd44baeba61", "comment": "Malware payload (Mirai)", "value": "88fd0396925c886f6bb280217ff9aac1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392741, "uuid": "f48f06ee-e6ee-4691-b80b-9d77ca3ad62d", "comment": "Malware payload (Mirai)", "value": "5c475a065746da43942cbcf0ffb0deb7039aef08a7ec43d91b4897f555916bb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392741, "uuid": "62b2ab13-db9d-4fb1-97a4-b962aad726a3", "comment": "Malware payload (Mirai)", "value": "fb447d025b9b7f780f3d0d1a3d9c4fb33cdb3e02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392741, "uuid": "89bc2aa7-4c2f-437d-99a2-f1bfa17c6869", "comment": "Malware payload (Mirai)", "value": "4fcd1ffd7d76d831c57f4a9e13ca9758ed7ae85d0e63c5da2ba8cee85bd0d858bcfaeaf6b675ff383a4316791989ff3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392741, "uuid": "a16bacd0-bbfb-4f92-9aad-f2e86acc5c6f", "value": "T1D0032A81732C0447C1B26EB0357B1BD0D7BBEA9222A4F389750FA74AD172E339546D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392741, "uuid": "c0973d7c-c881-413e-99c1-f7d3ca1d1c7f", "value": "768:tb1KC1aKm1/8IuVBPnlGnHHeWT3yYRIOpnKEU5:thERUh/onne63RRIaK35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392741, "uuid": "d88b325a-0f42-4250-b49d-520fd38ca2f1", "value": 38808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392741, "uuid": "932f4fb2-f9c4-452f-98ab-765bcc7d6542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392741, "uuid": "d803e531-9bc3-4a46-b157-e764dbe3455f", "value": "88fd0396925c886f6bb280217ff9aac1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7d6318-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691400357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400357, "uuid": "a4748ee6-1251-4b18-b7b6-2e5784f13525", "comment": "Malware payload (AgentTesla)", "value": "06dd67aeb0e2bce53b3adf6cfa22a8bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400357, "uuid": "25b01e79-d5cc-40f7-906a-51ba7e0f7c70", "comment": "Malware payload (AgentTesla)", "value": "5c5a8fa65e5c952adeabdbf099b75637ec169f5c74e41306a676876c8422915d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400357, "uuid": "448e20e2-eb57-469a-862b-a1e6b474dabc", "comment": "Malware payload (AgentTesla)", "value": "657b767bcba923d90c82cddd2e45b4884d92fea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400357, "uuid": "7ec8eba3-ac61-4103-b710-3183133bde3f", "comment": "Malware payload (AgentTesla)", "value": "5cba45a6ffdf86c75520d44f3766709ed831c12653e098637acedc703316d2d2b236c3299b1114adb9fb6dcb76107759", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400357, "uuid": "84c0093b-f9ed-43f9-8ca7-7907e7d5c0a8", "value": "T109327FED9E7450EDD30B52F759E42415FFA479A7E23E830E5DB0DAA4846228EC302715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400357, "uuid": "03173924-2409-4435-8636-43edb4f7f615", "value": "192:fya0NfYZISW/4N5eNA2A+EnVs+mg1SoBocJYlO36PvAKZ70AY96cWeqFGY3IeL:fyXfYZISW/u5+A2bkBdB1JYlOqPp709O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400357, "uuid": "1ef9ccde-2721-4e37-afc4-08d81f98677b", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400357, "uuid": "f1b14482-72bc-477f-afad-a5f0f32fa1a8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400357, "uuid": "dc8ba24e-b346-4e42-9e1a-939950f7dfe2", "value": "LPO 00864.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e75113c-3523-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691413544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691413544, "uuid": "118ab101-b252-4f91-bbce-d1d1d4d598cd", "comment": "Malware payload (AgentTesla)", "value": "0bea467b249b80de2c6a2ab8880f7c1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691413544, "uuid": "536b63e7-2e3f-4f80-8466-6025a3dbd1bc", "comment": "Malware payload (AgentTesla)", "value": "5c8018c014371e3ec6d9fe4c4d6c568f24e21e9e1b64960ecf7a650bd7b9b8b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691413544, "uuid": "784b1532-6857-4f5b-9901-62776da56f81", "comment": "Malware payload (AgentTesla)", "value": "a5a1b0d11ec2f2a1de21160bb9c47735231c0326", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691413544, "uuid": "2639081d-3b1b-4603-ac1e-4d9e6df5be72", "comment": "Malware payload (AgentTesla)", "value": "4cb11f4cc49d7990f98298232eb7b879bdab091f520cfa0783de5ad3f7fe96dbe0a24185720165612dcdde83525d8db3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691413544, "uuid": "18b62959-81b0-47fa-9296-70977e7f2b74", "value": "T1A915F725E77B654AEE29A5F84E1F803239D6DCC0F1B1C598A7E7280385C23514E39BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691413544, "uuid": "9f58572b-a849-4a6c-a0c8-29f744c226d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691413544, "uuid": "b485c9d9-554a-4511-b08b-8a665f06cce6", "value": "24576:KQ+/3Yrt/t2PYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO+OgumR36tu:Kp3Yrt/t2PYRs6CE3jLbO9Rs6CE3jLbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691413544, "uuid": "44773465-14e1-4852-94a7-6e9be9653b0c", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691413544, "uuid": "4f9b6a60-02de-4643-b1a3-2bf2bb9c5017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691413544, "uuid": "79106829-9edd-4f7d-adf0-ddccc5b990b5", "value": "EFT Remittance copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addf8a48-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691414214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414214, "uuid": "5d0c27f7-6174-4b70-b258-a48a5f589b2b", "comment": "Malware payload (SnakeKeylogger)", "value": "834b935a3e2549d7369637bb3689975b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414214, "uuid": "2269a912-3d73-40cb-837e-a340de7e865e", "comment": "Malware payload (SnakeKeylogger)", "value": "5ca7bc5b2b3f9d48d7f4bc33093a47215dab1224c60a8d5226bdc03df48f12fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414214, "uuid": "abd2e254-a19b-4e5d-b2dc-ccf6e946ce4a", "comment": "Malware payload (SnakeKeylogger)", "value": "def1c8c949b58a48c2f736b77cb400347b51ff09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414214, "uuid": "22ffdafb-6bca-4c74-b5cd-dbcd4249bc9a", "comment": "Malware payload (SnakeKeylogger)", "value": "b0f513a6d051c7fe039eba6391162bf0c6926374e6f6a21f4245ef0b4c7ea72bb78179273776d170a8756c6fc4c22574", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414214, "uuid": "b4d20301-489f-4549-9055-aa8793f8441c", "value": "T1BED42340699FE791EEBC97FA383C097E477A752A1522F3180F511CE86617F1D8A42E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414214, "uuid": "3397ab5d-af2b-4459-b3f0-68e4481af072", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414214, "uuid": "a32f47f1-2f82-4be7-bb8a-a766ff4d9f44", "value": "12288:UhySZxH6W/l0Nzr+fkdI8DEj5lcGGmX03PytC8x3M6Q:uHxHr+zr+fk6MA5lcGGmX03PmCA86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414214, "uuid": "a22d9f2a-d9b0-46b3-a510-4e905084cd69", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414214, "uuid": "6e5ceae8-b58f-44b5-9ecc-77732edfd7c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414214, "uuid": "cb91ff74-d7ae-494d-bc36-8eed971bcc43", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d1bc08-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400323, "uuid": "ddc76442-8df8-4477-aa16-a7de449f6510", "comment": "Malware payload (DarkCloud)", "value": "54880114a1abe00fbdc7edf2905d06fd", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400323, "uuid": "cd148098-85d3-4049-bf2c-fe190c73b289", "comment": "Malware payload (DarkCloud)", "value": "5cac3135dc313c8c3dafd118cbb22b37dd77808da2bbf2fb8a4469887c5bd49a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400323, "uuid": "03753b5a-d718-444b-a7f1-c3b06e94bb90", "comment": "Malware payload (DarkCloud)", "value": "8ed6e61531d7aedf14a2b07af4491f0df50692c0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400323, "uuid": "e66cd24b-e4be-4c58-af29-8cce23182b77", "comment": "Malware payload (DarkCloud)", "value": "ec8884369fb60fc889cee636b546e845f915e502cd16b5903aec56ee0e5c0f55fa74b60c482186a19e394949715be1e7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400323, "uuid": "670e2fa4-9622-48db-8924-73c1c8a07eea", "value": "T180844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400323, "uuid": "8c44bd72-0bb1-4154-8bf0-ed3f93dda167", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400323, "uuid": "48a651c6-1eb9-48d7-bab8-cbee1ff30af0", "value": "6144:qhys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:qhys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400323, "uuid": "8c1e6b8b-c8d9-4841-93bf-fd4b8e837d2b", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400323, "uuid": "4389e359-1cfd-45c0-8c9e-dbc2ac58e506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400323, "uuid": "bb32bb66-923d-4439-aa1c-937345a10c1e", "value": "5cac3135dc313c8c3dafd118cbb22b37dd77808da2bbf2fb8a4469887c5bd49a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e60ad58-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691381305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381305, "uuid": "f30a0c79-7a38-4fc9-bf71-abd0ff39aeee", "comment": "Malware payload (Mirai)", "value": "ebe12cfdd298c5081b93a77be8e0e3cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381305, "uuid": "81fbb18d-022c-486a-82bd-a8f6d381b489", "comment": "Malware payload (Mirai)", "value": "5d87142a388bfed27bbe660bf08da136e80385d1a030e89798f5fd8196203526", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381305, "uuid": "7439258e-df3a-41f2-8b8b-0f08f9baa9ce", "comment": "Malware payload (Mirai)", "value": "9a691ef1e8d4c3e6cb9630de93dca25e1800946d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381305, "uuid": "b7f04ad9-4e84-449c-bc39-b84d2193e888", "comment": "Malware payload (Mirai)", "value": "6f088014125d61be227d08703531345fa8e9c75514baf6b53af91d046eaed98898f5022467a323cc476b91695b264a85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381305, "uuid": "48fd491f-fec5-49d4-900b-f3098069aad3", "value": "T16363295AB9819B11D9C1127AFE1E518E7323076CE3EE73225E246F31678B46B0F3B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381305, "uuid": "be62d50d-2fc0-4632-b2ad-cf9dd4302ba4", "value": "1536:Uonyk2S7jp/6LKGCghIa26DEQ9M3i8CinURE7l45hYoq9:T2Ajp/6eghIa2RCinUREh4HHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381305, "uuid": "c482d73b-fcf1-4aa7-b776-e3b5197ae890", "value": 71188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381305, "uuid": "2d289025-6852-4b15-8f42-94b27d67157b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381305, "uuid": "6d1543c2-d1df-4060-b325-24c98453c9a8", "value": "ebe12cfdd298c5081b93a77be8e0e3cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c6ab24-357d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691452206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452206, "uuid": "9b221a31-115c-4590-b98d-48e590b8bf80", "comment": "Malware payload", "value": "9e081630ff8e48bdf6ade49a2d59c651", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452206, "uuid": "5503b2f5-ba3b-4e81-b0fa-44774b12c24c", "comment": "Malware payload", "value": "5f7ba5c47ff8d70a421e0013f916dac2d40a98f84b7390f54330fa62ef9204b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452206, "uuid": "42fc0683-64ad-4684-824d-e696c81636da", "comment": "Malware payload", "value": "3fed2388ee16a689fd8ee20474333a5a24d59a26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452206, "uuid": "1386cd0c-7225-4191-8480-c1cdc313a1ff", "comment": "Malware payload", "value": "73e579e84c5553069f556fbf08e086139915a1bc381e87456bf6ffe717fbee20afe500f1dbf0a95b409e291c45a784ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452206, "uuid": "6a03635e-6d1e-4db8-a217-3a37f7a161ed", "value": "T19A5339C0A983DCF6DD1146B83177FF328636F436212AE9E7D7D9A923AC81E41910729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452206, "uuid": "ae8615b2-528f-423c-b890-027c64fd4624", "value": "1536:VMzVhePhrkmetvEuckIzN/hkfgiu5BzZsYmrpY8+7UoBiAdpTLE:VMzVhePlkmetvBcxJhyu5BdyrpEJoAPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691452206, "uuid": "24cac709-c129-45e1-a6b5-eedba8ead1e8", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691452206, "uuid": "11ef6d87-8c06-433f-a68d-6d04462985ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452206, "uuid": "18dc7290-c51b-46a8-9262-fb6bc440a984", "value": "vcimanagement.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2384ca2a-34b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691366737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366737, "uuid": "b09501a7-3c2f-417a-b69d-22e7bde5569b", "comment": "Malware payload (Mirai)", "value": "6ccea0cbdf67ae481aeeb311bf8b1b33", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366737, "uuid": "9260c64c-6cb1-45c0-b847-e6558efade5e", "comment": "Malware payload (Mirai)", "value": "5fb05f152bab066521836fadc847a6cf265d2c721e71039d3500f13d812a4307", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366737, "uuid": "3435dc47-19fe-474a-8db3-f0c8b4bb0a5f", "comment": "Malware payload (Mirai)", "value": "2d99f29e42bec49bb755a599fdd4b4b95bb542cf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366737, "uuid": "2ce582e3-f990-4a4d-8101-d6dd2219b335", "comment": "Malware payload (Mirai)", "value": "8aa18f5808dde97a5553ebb48dd5c1b63a5928eed00a2d8a52e5cf02df4e419f555c941ca74766eb35027af923b983d1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366737, "uuid": "cea0a47f-9685-4549-bc0b-2113914b848d", "value": "T1BFD2E0E7E1F7A2F8D4F2B8753866DD80F99131779224435A017FBD86DAA734C5130A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366737, "uuid": "e82e7582-30a9-415b-b2f4-6bf2999bffaa", "value": "768:bYSoXdJZgicCHD+C98MP7L1YVPb2XuySx0sU:bYJdJZuCj+CiE7L1APbaultU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366737, "uuid": "0f6946a7-0b93-4e11-83c5-4bf75bc3a0c9", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366737, "uuid": "c657e07b-0419-4a33-9265-c0d6ccae6b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366737, "uuid": "d9403009-6acb-4fdd-bdcc-eb9cdc30b80d", "value": "6ccea0cbdf67ae481aeeb311bf8b1b33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8456bb9-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691390636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390636, "uuid": "843195d6-5baa-41e2-8c64-45214cc05cea", "comment": "Malware payload (GuLoader)", "value": "ea503ada337d9eb0a65a43df7de04256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390636, "uuid": "5b7156aa-adab-4c14-a3aa-d807182ffbfa", "comment": "Malware payload (GuLoader)", "value": "6065cbb9fb0ae29dbdeca23edc1869c329d71fa17cce27daead9fdfec4b48c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390636, "uuid": "61ead7d4-0b23-4bb3-b319-7ba19c976566", "comment": "Malware payload (GuLoader)", "value": "0168df2069b1cce3924cdb29d8be7b46c3b2cdec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390636, "uuid": "785a447a-f397-474d-9c32-74a9bff8e94f", "comment": "Malware payload (GuLoader)", "value": "94c90826ed1bbb9256069cb5538e0634a782e47f1acac9328c6a26312cf6f136ef45020415bd217810eb1fd9484802d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390636, "uuid": "27982822-f7ae-4713-b074-f3bd8ec2c538", "value": "T18764E007B65C971FE39A8BB2793903328758EF431A106D49BBD0FE2E157228DBD162C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390636, "uuid": "4da3c20a-d08e-48d3-b873-2a4714be9279", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390636, "uuid": "828edd7d-fc1d-45d2-89de-ceb5e9aa4830", "value": "6144:TQ606x7lsJ88LxX9BLPQtAfFADvrHdwJzYTFETjPPtzETIKZFFRh:368sxX9Jb6fqYTFETjPP+FF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390636, "uuid": "8b50796e-0602-4c2e-8ddf-d0a3d702e2e4", "value": 307108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390636, "uuid": "a33e7f2b-ee46-4ec9-9eb4-2a714f6fe2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390636, "uuid": "896d3eff-57f4-4527-bb3d-3d7be161d003", "value": "WB Documents No-285380XXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6624b222-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394767, "uuid": "fc22280a-c864-48db-8ac1-74980bba6fd8", "comment": "Malware payload (AgentTesla)", "value": "1d1bf3ebe5e28a65bb31586a1f41fcbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394767, "uuid": "f7b516d9-e8de-4752-85a8-760052f864be", "comment": "Malware payload (AgentTesla)", "value": "60c5ef3af7a3b790a403a31630ce8c27a43d21727823f6e010cbbdf2ea0e0a35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394767, "uuid": "3cd129e0-3f4e-434e-8d4a-437b9f8270d2", "comment": "Malware payload (AgentTesla)", "value": "dcf682155d1dd0fcbaa3b6c529722553e6e2724b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394767, "uuid": "dedecb37-5967-4f6e-b6de-b67834847b30", "comment": "Malware payload (AgentTesla)", "value": "3e7e0c0731b6800991286ff14845529800b966668ddf3eb5f3ae180cde3d1bc2ed0491762851eb5a85ef7461713582d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394767, "uuid": "156cb8e7-d309-4066-b266-6774310df776", "value": "T15A341E437E44EB11D2593D3BD2DF2D1853B2A0C756B3924BAF88AFA529412536C7E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394767, "uuid": "bd8ba063-b9d1-4000-a330-9eb0537b44bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394767, "uuid": "351b3d3c-e057-4a6c-bf17-15a904768f19", "value": "6144:s+PfUCuM0i2SNqxqbejH4v6DoJnZesZe:HuMuSNMqbeD264Ze3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394767, "uuid": "5bcd951e-8185-4452-a2d2-05b6647247f0", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394767, "uuid": "c1411058-06ab-40a7-8eea-c9c4194ab68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394767, "uuid": "0e260e06-abe4-4ed4-a1f9-9508c3cde5ed", "value": "60c5ef3af7a3b790a403a31630ce8c27a43d21727823f6e010cbbdf2ea0e0a35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfc2ff8-3541-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691426724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426724, "uuid": "4ef9d099-bae7-4f49-9d6f-7f8ec1301c30", "comment": "Malware payload (RedLineStealer)", "value": "3edf4732e86d8a3fca75cb7013a361b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426724, "uuid": "2c485603-5d90-4d6b-886f-09b8d9249917", "comment": "Malware payload (RedLineStealer)", "value": "612164ec216f6e25c1f821784bc36d3262acc5846d097ab3e1c92350c3ab4261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426724, "uuid": "8733189d-2766-44f1-bea2-591a05d4e702", "comment": "Malware payload (RedLineStealer)", "value": "63d71b214a3b2967f7a92b1357ea153ccd523b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426724, "uuid": "a3b3e137-a618-4879-9f1c-40629fec3881", "comment": "Malware payload (RedLineStealer)", "value": "b26e6cafbf45e4001a8d98581a9592a115d6ddf9bebb15a5a05017c14f521b38343d17e656a0658dfc663cc56f652c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426724, "uuid": "0202da51-e3bb-4868-a64b-c206b6e04349", "value": "T1C0F38D0294849677D197B836FB60AA62087B7F8309724579AFEC1EEACDD72F0117C528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426724, "uuid": "7d69da02-7e6c-4b4c-a273-e30ad65c762d", "value": "755b093cafb5bcbf0738487b698785ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426724, "uuid": "8eb49a8a-1282-4d23-953e-269c69701c1f", "value": "3072:c4NdGCdEtsP2SyomYTHDb4S1I8E7b6KDhVLI8bxKI:c4fGCWmPwYMS1cAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691426724, "uuid": "a7014025-1e74-409c-b04f-6f963a7ca9cb", "value": 171416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691426724, "uuid": "12a2ab05-bfb9-496b-8e5e-54cf5a3a3757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426724, "uuid": "efe0e834-1ae1-40e9-9bc5-6dc7e7dc9da4", "value": "3edf4732e86d8a3fca75cb7013a361b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070c2ba3-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392460, "uuid": "d360dd4f-107e-4792-8436-cea300a27f26", "comment": "Malware payload (Mirai)", "value": "2f49055d490541aa15147dea3707423c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392460, "uuid": "38a6a04a-6160-4e87-a9a0-f5867eb65b36", "comment": "Malware payload (Mirai)", "value": "620d07e67ec602dcc746d30bbe5d75bcd8718ce0f52671d07b6a84cbe7f5e6ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392460, "uuid": "9ed04f9c-17f1-42e6-a60f-a84af25c46bb", "comment": "Malware payload (Mirai)", "value": "8eb30bbb290f918c01c26c71c311b85e87561856", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392460, "uuid": "75c83394-adc8-4f63-af1e-dccf265eaad9", "comment": "Malware payload (Mirai)", "value": "057c5b18e8d2e3cedd4e48571030285ea4bdbf4eb89b49d896a27445ac27c1bcf897c4f32de2f3ad7acba4601287ee3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392460, "uuid": "15c88985-0352-49ba-be33-7be1db3f556c", "value": "T1EB13E684B8829E1AC6D0537BFA0E82DD372973D8E2DD7303CD156F5237CBA2A096B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392460, "uuid": "f608fbfd-a95c-4b35-baf3-3bfcf4fd94ae", "value": "768:T+dVv1VtO5PoG6wo5kolmBDQkgmOApMzJO4GEqTMi1cnHPQgx:SdVk6vjmNgEpMzrqobn4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392460, "uuid": "76309f31-6812-4612-987e-43fe78baa215", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392460, "uuid": "a768bc23-a9a7-4924-9f2f-d5eb9bf6ed9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392460, "uuid": "74ea0b74-2ae9-4c5e-b1cc-9d0b545b1c7f", "value": "2f49055d490541aa15147dea3707423c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2a469a-34fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691397595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397595, "uuid": "4788fbb8-87c2-46df-b343-6a4c8d618450", "comment": "Malware payload (DarkCloud)", "value": "5eee3a0ad165707b2a51db0b461eeb1e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397595, "uuid": "747491c9-3536-4b30-905d-cdec4b7336f2", "comment": "Malware payload (DarkCloud)", "value": "62456d25e43ca60a3c6763d68a70b39d09138b56b287a40f95584b563ac5bb11", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397595, "uuid": "0cd07b49-32e0-4008-9bd0-55c35dca52c0", "comment": "Malware payload (DarkCloud)", "value": "0c2ed9b0a6762d363328ece108e20a4cb2101b8e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397595, "uuid": "7aea387b-86d4-4122-ad91-92562a57baaf", "comment": "Malware payload (DarkCloud)", "value": "83af69ec7c6841122e6fe7b6e077f5df1dd27e5bfc10bb54819f38c45b95580614817971af6778f45e1c84c1fe7f53e7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397595, "uuid": "e3cae51d-32d2-417c-acbf-ac7d4f3fd6bc", "value": "T190B40626E721702EE1EAC8F1E6E8526768146D761198E827F7C15F4D32352D3A8F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397595, "uuid": "f2d5650e-34c0-487c-b516-cc6e7e4e14f0", "value": "e54239e86b9cff7ce74afec114ce6400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397595, "uuid": "626d3f61-ebba-4fc4-896f-e76a9161c744", "value": "12288:C96BEnIHYA+2t3xny0I4d2Nqnp4vRqMr/jYKkJj6GmZU:xB0ZAcTInp4vcEYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691397595, "uuid": "96acdad6-be43-471c-90ac-d1f125ad46d9", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691397595, "uuid": "a43ff5a7-57d8-4a66-8ba6-d11e733a9114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397595, "uuid": "d8de8407-9923-414d-bb7b-7915f40b8224", "value": "62456d25e43ca60a3c6763d68a70b39d09138b56b287a40f95584b563ac5bb11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00568dbc-34db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691382570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382570, "uuid": "c3b552be-e0f8-43ba-b983-bcace3728d67", "comment": "Malware payload", "value": "63a97017f63052b3a9d2abbeecb3c39e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382570, "uuid": "049e65b3-2a02-4856-9b2d-22820be694a0", "comment": "Malware payload", "value": "63e77a05ddd8a2061a582ac1fd0354643b74bcbe2ce21bdaa23e6c95fc461402", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382570, "uuid": "356a82b7-f6e8-41b5-8400-545fd01c4924", "comment": "Malware payload", "value": "264a44877e1fc56393fc4049801b7968a33d26b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382570, "uuid": "7dfccc9c-ad91-4a0f-a06f-07d9488617c9", "comment": "Malware payload", "value": "0d256f30b779477da7dfdff8dee7a2019c440784c6cf9e2d6449f1a5deb4d2ec9931b1f8a13a98623a023238c4128793", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382570, "uuid": "64f76eb2-72ca-4619-8117-f3ae902a9ec6", "value": "T138227D37839788F2FFD699B70F1B002D7738492A235983218755009E5FB8B99E67635C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382570, "uuid": "3ce342f8-8c36-4724-ac7c-a32fce769cad", "value": "ade319425a5a03430e1ad57861abc6f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382570, "uuid": "eeb884c9-a73b-4d7f-8ed7-1f060f53700f", "value": "192:qHu6mVCPueoXMJtz+rzvdlvT3FE5LL+tU/F+1Fhny:qt13x+Nlvvr9ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691382570, "uuid": "3b7eb307-6a6a-42ec-97e1-8857182499ee", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691382570, "uuid": "c17c9828-7be7-4167-869d-c2e716394ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382570, "uuid": "e624a793-1672-4f75-8fd2-ea7b53767ec5", "value": "SecuriteInfo.com.Win32.InjectorX-gen.3238.441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e996805d-3517-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691408731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408731, "uuid": "541615f7-2577-4d4a-84a1-dccfd5e636cf", "comment": "Malware payload (njrat)", "value": "3507e1c0a846b0e399ed66a4e16113e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408731, "uuid": "2a0e2b42-1d39-4451-9854-0587d1a886a2", "comment": "Malware payload (njrat)", "value": "65ca589b0756f399638736bbed0bf7fefc438c482b62fe75b405f07d9be2234e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408731, "uuid": "15e0ffe7-f3dd-4b76-a95b-6640c71ecd7b", "comment": "Malware payload (njrat)", "value": "2d3e1d3bb63150b41d8fa5ef455739f9f78bd3d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408731, "uuid": "0ac84f08-b091-479c-9023-238a6fb4a37f", "comment": "Malware payload (njrat)", "value": "7974d8bdcb68a09d90ef32170301d63d01f243d1a35cd524806c3db00790c661b005b3052f50820dc34e8c3a45f033e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408731, "uuid": "709aeb95-4e82-4d03-8ced-32ad538a455b", "value": "T1B8F5CF38A502493BC83A17785C6BA37857FC3A04257EB787B7A8599E9FF734461A0343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408731, "uuid": "e4c0f053-4cb1-479d-a63e-68f7fef37b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408731, "uuid": "1c43f586-f2b1-4097-8e16-af0e0bf83297", "value": "49152:V5JEAOSHaNvPTKIO59eK4TSc5dd+qQvmH+mk79pD:VTEAOVluIseF2cp+5vqZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691408731, "uuid": "eed1c753-98fd-475a-bcc5-d67acd66efac", "value": 3612672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691408731, "uuid": "a8700f07-4afe-4554-8f13-4dc6d5ac82fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408731, "uuid": "f462e152-d263-4590-a8f9-c48d17a5b8d7", "value": "3507e1c0a846b0e399ed66a4e16113e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c937007e-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414260, "uuid": "0c353aa4-188f-4ebc-b1c4-2797323fca10", "comment": "Malware payload", "value": "bebf99046a8c55e41d856134f3fcdd2d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414260, "uuid": "d63f8cfc-6c70-41d4-933e-0d750d4d2cec", "comment": "Malware payload", "value": "6786a8e6b2abe9fec6464c24a92e982e31d31ae8caabe927625b78b6f1a2c840", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414260, "uuid": "0b3acac3-2187-441e-b8aa-68bbaf728cf6", "comment": "Malware payload", "value": "ebd6b822c2fe7feb352dee6602759d99389e0aaa", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414260, "uuid": "9d5a2261-f660-46b5-b57f-0bf02c0caa52", "comment": "Malware payload", "value": "06a0c7e8e19d0ce529daed0d544c57994bb047746ff71817b7bb4c159cd97231aa573f7eb4744405dbc659d094dd1ce0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414260, "uuid": "591c2b2e-b384-4f4a-a4bd-414c5dea3816", "value": "T18905D0079C598B43D46887F8BD434EAD1F093E1C98927AEF11623EDB7E706224D8E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414260, "uuid": "338dca12-0767-46b3-95b9-69061f4e1e05", "value": "24576:A+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXbVeixz5YN2Tsg+JA85Vvua5:l612shWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414260, "uuid": "887e6a56-c8a9-4612-a9d3-4bf39984ebce", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414260, "uuid": "2b96df23-f719-4eae-a7b3-b809b78b8dbe", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414260, "uuid": "ddc453ad-4eb7-4ac6-bec1-950a3d91fabc", "value": "Dhl Recept-673gtrvs.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aed79f-34fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691397527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397527, "uuid": "26d662f1-475d-4831-ba1b-90be1c59029b", "comment": "Malware payload (DarkCloud)", "value": "4cafd28c3d8b329b7c131efd5b3ebb24", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397527, "uuid": "6f5aa0a7-e262-49ad-9bf8-d4a7218802e4", "comment": "Malware payload (DarkCloud)", "value": "67f025389874285ad223869693aab889d3649a74f8d955098726ac3b872bf840", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397527, "uuid": "c3d28a15-73c9-4820-9524-5e01e98d5a58", "comment": "Malware payload (DarkCloud)", "value": "a42e923a1dc056264e3aa9fa1ee7ab97fc3021ec", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397527, "uuid": "45d62752-dbc3-4925-8121-21f2383f2f66", "comment": "Malware payload (DarkCloud)", "value": "77734690b11599af78e573b7c9333f019364bae13da14d67b71fa4a3479e6ca99a7dd93282d2d23b895b3bfe75a123e1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397527, "uuid": "522f9771-7f12-4d3e-984c-6ae5bfbc606d", "value": "T10CB43A26EA20612EF063C8F1E6E452576894AD7712A8ED1BF3819F0935351D3E8F172F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397527, "uuid": "d4009760-f8a6-4156-8435-be884a39813f", "value": "12288:6Znq9ahuwlWR7Gl9vzZ1dl/LxMrKCqJjYKkJj6GmZUN:GhVvl1dl/lMrK3xYb6nZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691397527, "uuid": "59b63ac1-e9aa-4749-8539-955f0dea7aa0", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691397527, "uuid": "cb5aa9de-7ec4-4fd2-9a5b-20c721c46526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397527, "uuid": "682cdef4-3a31-4c66-a886-bd445373b479", "value": "67f025389874285ad223869693aab889d3649a74f8d955098726ac3b872bf840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcbbdf4-3571-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691447423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691447423, "uuid": "7ddb5074-dbb4-4856-89b8-d7ecec4c9002", "comment": "Malware payload (RedLineStealer)", "value": "41d15d257d3635c6a5cb7445c6f10fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691447423, "uuid": "e2a2c380-18a9-4c80-bfbb-012d9ff9a20b", "comment": "Malware payload (RedLineStealer)", "value": "682fe85766a186ec36dadc209b29ad21498e73e8459035de33c591bbbc21b3a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691447423, "uuid": "66db13e5-a85d-4687-890b-fea714e378eb", "comment": "Malware payload (RedLineStealer)", "value": "c3185ab37c6508da6a8eda664f24c8ad9553db32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691447423, "uuid": "c5621c57-c41a-482a-bbd1-3cada2674ae7", "comment": "Malware payload (RedLineStealer)", "value": "011a8d85840d37a5830e549dc5392c3f8e1b540fc2e8f9bf60939e069079538733e749f5fa981949f973790ebf779719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691447423, "uuid": "d30349c6-63fd-4db6-ab8e-05deb065ddb3", "value": "T15994392EF5009E35CA8C57B45DE7827D90D0600B52376559A739E8EC3B70FEF72A0A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691447423, "uuid": "0ca1fe6e-3c4e-4bfa-a77d-dae99128f2da", "value": "d291ed1dbfa05ab0e2b28bf8d5ac6646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691447423, "uuid": "6a4e0dc4-8198-4ded-b9c2-ece1259adc86", "value": "6144:Fn/THv45eLjL8tUs93dral9nSx2llNN7lWAu6UHx5149ivPBB0Prdk3OOf4c:VD45jdralPNNJWV6UHx5syBBCpk37f4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691447423, "uuid": "9f62fe6f-07e8-4d1f-b746-26ce6ec13da0", "value": 417968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691447423, "uuid": "61a1246d-4c7b-4014-ae0d-7df289143af8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691447423, "uuid": "1b13efa5-4030-4ce7-863c-e872c0347e79", "value": "41d15d257d3635c6a5cb7445c6f10fc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fae17c-34b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691366733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366733, "uuid": "0c31859f-1d87-4adb-b70a-7e4dccacd3cb", "comment": "Malware payload (Mirai)", "value": "58c9d67782369162e5b4a7625f4b7c35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366733, "uuid": "f30dca82-97cb-4c74-bbdb-dac6cbf4e453", "comment": "Malware payload (Mirai)", "value": "6834dbe8d044696977c8afaf635200eea247c963fddff1b02c4b6acac3b8084b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366733, "uuid": "a94fcd4b-997a-436f-9c01-515270f0ab6e", "comment": "Malware payload (Mirai)", "value": "5cb1b781a2ec454a9c7597204539321532942cc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366733, "uuid": "91d5f8a3-3cfe-4780-813c-65fcfaef6f16", "comment": "Malware payload (Mirai)", "value": "7d6ed817e0b364c9439d154581fa8132790150980896b721a066f7e6d51531c61a6d6795808f7b77ad5ead43e020b8c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366733, "uuid": "0d37885a-e27b-44a5-bcec-563cb568676f", "value": "T1D3536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366733, "uuid": "450ee1f5-d7d5-4f47-b47e-64eea76b0e51", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8p:p5VHV8I9cKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366733, "uuid": "20eaa030-ecad-41e8-a92e-88db3a14b811", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366733, "uuid": "962e368c-dc60-41fd-8801-013d2a83d26d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366733, "uuid": "66990f2b-40c5-4104-988d-bbef92da31e5", "value": "58c9d67782369162e5b4a7625f4b7c35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823690b0-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691372480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372480, "uuid": "a87ff438-1a54-4f6c-a025-b1ed88aef89b", "comment": "Malware payload (Mirai)", "value": "78afb955c28b76df100c2f3d98170ff5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372480, "uuid": "8cca9122-85ba-4e09-a90d-60f1b82e4db4", "comment": "Malware payload (Mirai)", "value": "6c1ea8565540ad09758145ca73504aafe13e711b8c0997e109d6a36e02900bbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372480, "uuid": "23139e60-3c0b-4ad8-8a0d-7302bb10e4f3", "comment": "Malware payload (Mirai)", "value": "78d866d273bec0313b64db92c3a7e062d6f3e17b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372480, "uuid": "8522a3bf-cb75-47cc-9c3f-801fae7b4680", "comment": "Malware payload (Mirai)", "value": "7017beb582438f7dcd42cc64114ecefb914fbda4322ab1a78f8bcd89a293dfd3bd76451f8cb5a64bb9fdbabf62ab57e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372480, "uuid": "9e352af8-7882-455d-ae54-cb5fd2127cf3", "value": "T175539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372480, "uuid": "c94ee539-2cd7-46c9-9e6e-77b14d5764e4", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372480, "uuid": "58ee1c08-9cdc-466f-8c89-45191f0920da", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372480, "uuid": "4879f23e-d189-4993-a115-bac6d3e147e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372480, "uuid": "3f1629cc-4429-47e4-a1c8-1a26fe959988", "value": "78afb955c28b76df100c2f3d98170ff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8b8734-34bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691370004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370004, "uuid": "e96a98a7-c526-414a-9140-cdc89611ece4", "comment": "Malware payload (Mirai)", "value": "2739fc3d4e37a9fb551039927b48d154", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370004, "uuid": "3a89262d-f9f4-4f9a-b2c7-744e4395f543", "comment": "Malware payload (Mirai)", "value": "6cd9f58ba03783ecf4ce41ceedbf30d893213da57eec776e7e93114c53a9c6f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370004, "uuid": "cd989504-0ab0-4e5f-9ba2-08fb08f34a3f", "comment": "Malware payload (Mirai)", "value": "82fe399c591b314743bcaa35cc5142cf22518b28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370004, "uuid": "48586cc2-35b5-43da-ad20-9e81037dbcfb", "comment": "Malware payload (Mirai)", "value": "fc75a62a9a07bd053e26ffd934069d130a7ac2c1dd741cce0974dc79143a1d64963395d40df96e4c718a7d62f5a0a4cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370004, "uuid": "c0a599d2-5afc-4a46-ac71-cbd525caba1f", "value": "T1E733F262676D29E151B08777BC32AC1AA69C17B89C7730DA2CF0691577C58024EF2786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370004, "uuid": "f4d54424-d2e3-4655-bfb2-3d959123974b", "value": "1536:j9O/ZMAXIxNUk0N1LcPqF1aBexo4opKZbu:j9O/ZNKyJ1LGqFUF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691370004, "uuid": "1dae8743-bfd9-46a2-95d0-3ec477828f7d", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691370004, "uuid": "9a41e55b-04d1-4c1a-8532-d293dc4f072e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370004, "uuid": "86abbb55-33f7-4d99-b4a5-674421c5a5b7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3476b06-3555-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691435242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691435242, "uuid": "865f1afe-5246-43d3-89bd-dfd68148ea0c", "comment": "Malware payload", "value": "59269d016ddddab846010ef4f12421ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691435242, "uuid": "1e6d43d1-dca2-4948-80e1-78693941a68f", "comment": "Malware payload", "value": "6e81917232d1900d943bbb73b5ac5a96453e17896cdcf2b309242be6cc988dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691435242, "uuid": "10ceee85-b7bb-4966-99ac-df83f571ab90", "comment": "Malware payload", "value": "c9104498b77bbad8e63a7731aaa829418c62f8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691435242, "uuid": "19ab6a29-f51a-41a8-8be2-53ab846d7bfd", "comment": "Malware payload", "value": "26923c0195848a516ffe34a48b4ac7c839a98dca3526e5ed6f93fa39c45a9b9f582ea51562c14e36a1fb575e1b97edbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691435242, "uuid": "6b307e2f-a1af-4756-8d62-badce2f63e83", "value": "T1ABC239593FA08176C2EF6BB406B2D72102B2E2074A27DB5F4CD844FA6B777C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691435242, "uuid": "88e64d99-9d9a-41e0-8257-b5ca7c3b2d61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691435242, "uuid": "c8954f07-d8e8-40ab-aa76-56b6072de264", "value": "384:LLd6haZIVi/dMkt1cpDkjetHzCYe/iBY2OzRLTm3yilqr63sbPtVvGf:fw0IVi/dMc1uT5e/gsEkVvGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691435242, "uuid": "ddb5849c-5130-4a5a-aa1f-a94cd446e588", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691435242, "uuid": "8fa50c88-c84a-4d25-b67f-dc69015c065e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691435242, "uuid": "5bd557ec-741d-413a-9f8c-8770f3c8be4c", "value": "bOIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47368da-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691414735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414735, "uuid": "8a081e2e-7402-4682-82ec-5a7e82b28195", "comment": "Malware payload (Formbook)", "value": "c5b0b4e64f077076496caac633a53140", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414735, "uuid": "d5a12804-5419-4f0c-8501-c2a239bd10fd", "comment": "Malware payload (Formbook)", "value": "70cccfd28bad2293746e594553271daf4cfa428efb56eed9f8be1cd4c1b5fe21", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414735, "uuid": "6f175df2-0175-4f88-871b-51c0f644bded", "comment": "Malware payload (Formbook)", "value": "d67d41e450bf621f4fd9f5b7c25b277e92110ad1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414735, "uuid": "d6561cbc-583b-43c3-b7e3-749181959a3b", "comment": "Malware payload (Formbook)", "value": "a7c365f2aceb2fa7493e712e3cae1ece21935ea4266605ec06847e8ad846997771add218958fd83cff8c67993debefd3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414735, "uuid": "6650fd3f-63e8-4ac6-802a-395c60d64caa", "value": "T1F563366CD38F02A9CF52527B9A660A5441FCBB3EB38511B1306C837933EED2D61265BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414735, "uuid": "4656af85-95dd-47d7-8920-4e0205913273", "value": "768:twAbZSibMX9gRWjiUXTZdtiXbZAHNNhneG9NvkVnOHtGUdItDi6+YF:twAlR5WvtiVSN/nLLAOHwUStDZ+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414735, "uuid": "5e51846b-ef2c-4e79-a0ab-c54f13ae782b", "value": 68010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414735, "uuid": "7d5ab91d-1aec-49b1-82ee-1e49416982d4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414735, "uuid": "a7ba1a02-2bf1-4de2-923f-dd28e7a77fd4", "value": "SOA510378.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672a69a5-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691394768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394768, "uuid": "6873ea55-b479-4f4f-a25f-732e73619b7a", "comment": "Malware payload (Loki)", "value": "d1b1bb39ffa6614c232ce1118cbc5079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394768, "uuid": "28f4c46a-020b-4039-b780-9a84062d25db", "comment": "Malware payload (Loki)", "value": "72878ab3387ac95eedd87ded0919869421fc9062d50c3d38e16cd4d754c0d72a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394768, "uuid": "dabc1fe8-215e-4b72-b51d-a6d3f62a1c42", "comment": "Malware payload (Loki)", "value": "c30e2487b6599b521695bd4de172ad6dc81d90d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394768, "uuid": "91e39811-fc8d-4526-bfd4-23d79234ab24", "comment": "Malware payload (Loki)", "value": "dc9ab76db1af297fd1410b2f56a973765ac850f286a66157f3c1a8ab27a9cffc71a39acfd88468d5aea24132a757f8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394768, "uuid": "da15ac3f-7cdd-4cd8-b5cc-bd344cc0d555", "value": "T104A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394768, "uuid": "3f6d427e-6303-4489-8f2f-9aec14d6b66d", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394768, "uuid": "613ead12-9fee-46a2-873f-f5fea25ed395", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394768, "uuid": "534e3c9f-b7af-4659-9001-83d23744d5e3", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394768, "uuid": "cb31d114-0db5-414a-932d-a30dc7a3a2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394768, "uuid": "e0c8f551-322a-45be-9915-8e61606c37f1", "value": "72878ab3387ac95eedd87ded0919869421fc9062d50c3d38e16cd4d754c0d72a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c352ac-34fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691396972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396972, "uuid": "456b023c-dc5b-44c6-926b-535a095c4739", "comment": "Malware payload (Formbook)", "value": "5c6c78221f1af804f7736f3f288b3700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396972, "uuid": "7af5d68e-9e58-484b-82d2-4c45f5a914f7", "comment": "Malware payload (Formbook)", "value": "74645f76c215c157ae8a3243f04ad0de53429ab1f4d771e55ea92ea111f3cf2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396972, "uuid": "5dc3285e-fddf-4e3a-ba80-e55a3a1c906a", "comment": "Malware payload (Formbook)", "value": "a93a4aee116d3eaa5d8deb78a351dfb15698f678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396972, "uuid": "8cc189ce-5b28-41d6-a176-b22c1657ca3c", "comment": "Malware payload (Formbook)", "value": "0028197515c6c2c5fe1e66b2084f1f4d7e2683b9715f5e175f1330c43a5e6a371bb07ed864adda6aed9a2ae7ef6a95d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396972, "uuid": "b1f3796e-4238-470d-81c7-7b0c7fedbbee", "value": "T1C20412C2F1F6A718D4B7663B5207FDAD49020E765360EE0EA3E54B54E4E10E53D3A88B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396972, "uuid": "b4a4fbe0-25de-428a-abe3-efa82b74785e", "value": "3072:0VMRK6860njvUODI+qU3V90GT7UU2gR1D9LZFVi7Hf4Faz7C4iOiUYm6rZ4odu:08fsAlU/vT7F2g39LgL4FaMTUYj46u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691396972, "uuid": "3d377dd3-60d7-47eb-a902-04f5fb052534", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691396972, "uuid": "cd179e0e-8b7f-4809-adb9-fc85c6cf2a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396972, "uuid": "ae10b1ff-9f6e-48ce-9b5f-31d7e46e29d0", "value": "74645f76c215c157ae8a3243f04ad0de53429ab1f4d771e55ea92ea111f3cf2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79062c31-3501-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1691399093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399093, "uuid": "e74dbbbc-9f9c-42dd-aa62-77b9d69c793f", "comment": "Malware payload (Rhadamanthys)", "value": "4c224ad23e402d58bbd23023bf883dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399093, "uuid": "7d38631c-ab2e-4dbd-bb0e-e21a0ca1a972", "comment": "Malware payload (Rhadamanthys)", "value": "74a434ab27dee2234cc149fa8d34c6d5af5beaa0060ffad7523fde8ec923f983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399093, "uuid": "fcdd4cf1-ffa2-421a-ab96-7ec95bb84ac0", "comment": "Malware payload (Rhadamanthys)", "value": "67cbaf4b24ccf90ca845626d1ed97831ef0dd55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691399093, "uuid": "7d5afba1-61fd-4753-9eaf-37d8d2e7c973", "comment": "Malware payload (Rhadamanthys)", "value": "188591543c375204b3c052ce52263a7569cb0164dce57adf82611e3f319445d1c06e60f3aeb72c62261f73513beae370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399093, "uuid": "39957572-8754-4992-bd0c-6bec68eeb7e6", "value": "T18EB4CF1362E56871F63346738E2AC6E8EB1FB861FF5477EB12589A2F09701E1C672341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399093, "uuid": "615f4b7c-8cce-4200-abb3-445d572605aa", "value": "497066eb74b90edfec949c6dfd6acab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399093, "uuid": "4f0f7dbe-cc98-4f26-b7aa-a1ef39d19d53", "value": "12288:hwp22VqKfpoJfgq+mugd256TJzxpQodc5X:hwp26PfOJfgbmBT5c5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691399093, "uuid": "43cd1c9e-4ae7-4fec-a8f8-27cf460f8a53", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691399093, "uuid": "e3b6f57f-2e7e-4bcc-97f9-f14b9c0e28d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691399093, "uuid": "4f7de09a-0c51-4899-880a-e25b1811ce5f", "value": "SecuriteInfo.com.Trojan.DownLoader45.64415.16073.8707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ece529-3508-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691402017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402017, "uuid": "878958e7-13e9-485b-99e2-0e2388e470bd", "comment": "Malware payload", "value": "e6b9956632d5687c0e7e1ceb3bab3db8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402017, "uuid": "e3c4c3e1-face-4397-b2cd-36be5aff5fc1", "comment": "Malware payload", "value": "74e69ad4030e937fdc3fbf1b6a973db9564e8ed717198525fbaba73c13c5c6d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402017, "uuid": "3df5dace-a08a-449d-a768-fd685ee42349", "comment": "Malware payload", "value": "f4b5c3100a2af0639c2dbc75bf728e633b26addb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402017, "uuid": "b8c0f788-ba11-4939-a385-390d2e73a429", "comment": "Malware payload", "value": "7b15ec828ca350e6109b4ca7eed85b0a9ffd6284bb24aad21663a059b2124de9166d27bc623c843e4b2621db4c37a2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402017, "uuid": "a50ba5c7-d0b9-4f7d-9dec-569e3077bc23", "value": "T12926AD13F322D364C1D82531A9A2CBB91B74FA415C21CA6BB6B8DF6E7C312537E5618C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402017, "uuid": "a056b1b9-e6b1-4bf8-a3a7-a4012e5fd595", "value": "1257f4f00b26540317d697ae51fa24df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402017, "uuid": "d701eb66-f1cc-4751-95c5-9eec867b6a0f", "value": "98304:21Eevg79YIJZwj1l8L1p8Hc0gMeI3HlUsyuE94BJBnkKMmUgQ2dej:ycdH41l8XYhg3glryrKAKN7QZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691402017, "uuid": "55f9482c-7afc-4bc9-abdc-bfaf827ca9de", "value": 4653056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691402017, "uuid": "02ef8c84-2b5c-48c5-9225-7e48c858921d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402017, "uuid": "ed49a2ae-be21-4a37-9cf3-1f6079fd7a9a", "value": "74e69ad4030e937fdc3fbf1b6a973db9564e8ed717198525fbaba73c13c5c6d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaab3f2-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394774, "uuid": "df302fb0-5800-436c-b932-acb9c140a8a2", "comment": "Malware payload (AgentTesla)", "value": "02f3ff87605a6d044bb94c2b93695d94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394774, "uuid": "dc64687b-5425-49f9-923f-577a5aec8e8e", "comment": "Malware payload (AgentTesla)", "value": "769addc28bca21662b1736bde05e0db5a447132b828d0644a85982a020af4f2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394774, "uuid": "65e85747-3d1f-4651-9480-4ee97743482f", "comment": "Malware payload (AgentTesla)", "value": "bb40918234677487675ae0cc21850169d4b4ef90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394774, "uuid": "93fb8055-b1cc-4b6c-aa26-610fedb48181", "comment": "Malware payload (AgentTesla)", "value": "3ccbcc88236df386c7d50a53341c2282aacf4c28ab20eaf3db8e60c89e781d49426d1c5edb2ac5c7e3723f263f756264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394774, "uuid": "a69ee1fb-6461-4b62-8a98-33ab582fba54", "value": "T1BA74F041B1856B05D0F2B7F896B5114203BA7CA21029D35E8CF6BAE826B3B53DCD271F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394774, "uuid": "54542877-71ef-4c0e-8aa4-f2eab3275e34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394774, "uuid": "e1533264-f32c-4e37-acce-e97ff6aa9a60", "value": "6144:XAiQyCAdifiLBGCcL7wCJlc4ZWUr7lO0yYgANYk0MbEVD:XAiQyi8GCnEi4ZtnlO0yYgIjfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394774, "uuid": "ddfac7a8-8a50-4452-9948-4de0bcab1197", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394774, "uuid": "8615ef03-9a08-4fde-a9ba-8bb49df42da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394774, "uuid": "aa114d64-12ba-4290-9574-ad591c75afab", "value": "98765456OR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00be680-3527-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691415560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691415560, "uuid": "c3515e6d-c322-481d-a280-0c80c4fd1a8d", "comment": "Malware payload (Formbook)", "value": "d0ff0b732424f3f1b89d044b816b339e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691415560, "uuid": "a7ff55ca-5116-4ec2-8a62-6326d3daad40", "comment": "Malware payload (Formbook)", "value": "77b2df747c5ded816a5baa3d1f38beaea588aa7f4d043d7b9e9c5d67991ad852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691415560, "uuid": "e000aead-bd5d-4013-ba92-5f45a2a5aa0d", "comment": "Malware payload (Formbook)", "value": "1a0c33516261e609cbaeffc965dd0851b9be7b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691415560, "uuid": "b83929cf-7034-4747-a87b-2f54061c2db4", "comment": "Malware payload (Formbook)", "value": "94fcc25a0c44b49e17e78abdefdd8c1cbd969b84f3eee73af95882e06776715ffc9f3892e134ba86ff7dbae7acf3da8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691415560, "uuid": "ca1dc8bf-f466-43fe-bd7c-b65fe92a39b0", "value": "T127F49E741696C60BE41B1734CCF2E3B17FA94FA4A2E6C7474BE47CFBB84A05666820D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691415560, "uuid": "24901025-bf1a-4b23-b714-e0dcc8311474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691415560, "uuid": "726a2a76-f3b8-450e-acc3-0cd849317f48", "value": "6144:/tT+iT+GEQg1AkUaUc7woFMNY13PaNjnfQYmsu25sZnDuqTPcg1I6EZWT1szmlzf:/tBz2UawK1fqfPK5lbpbhuzlUospNlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691415560, "uuid": "5e9bb052-a1e1-4d89-bd72-27e753d3d4be", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691415560, "uuid": "de2fc198-2f5b-4580-9719-3f2b493b269f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691415560, "uuid": "a9f81ae4-4685-4e30-90ff-5197240c6886", "value": "RFQ# R&E-S194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e882ac3f-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414313, "uuid": "124f46d5-3e00-4bff-9f83-e7c8ab814210", "comment": "Malware payload", "value": "72ccce79a4d5594039bd12d9b410b5ea", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414313, "uuid": "08bff245-e51b-4579-b4e4-ddb28110bbc0", "comment": "Malware payload", "value": "77bc5dc028982adc958293c6e2bb7172c31e0a8504f87324be70db87e8319688", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414313, "uuid": "438da6bf-48f3-4cbf-bac3-7a1f9a7ae0b3", "comment": "Malware payload", "value": "cbcae1f7e313f8794841e301190f6595ef69e198", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414313, "uuid": "1b6fca9c-48a2-41e7-8fa9-fc6b7c1471f1", "comment": "Malware payload", "value": "40c8dd62b609bd53538dfc05760b5bf08d2d2ea64fd92b013c9a5a7bd56e70b70b76f0e52233d11a9986edb9fef30756", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414313, "uuid": "a5135f47-55af-431c-a29e-24b6535cd2ee", "value": "T1C5E23DA6B2C6D806D95807794CEBC6D66622FC616FA3834B3389F71E1F71AC08903657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414313, "uuid": "8105bea9-4b80-4fb0-9d66-96f469444d62", "value": "768:N4P1k3hbdlylKsgqopeJBWhZFGkE+cL2NdAJRqwqMhWzNI03x:u1k3hbdlylKsgqopeJBWhZFGkE+cL2Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414313, "uuid": "fc9d4ae1-f6e7-4a2d-8498-09b9d6296b54", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414313, "uuid": "9df70659-3e21-49bb-b5d8-0a02474f2a4e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414313, "uuid": "fe3cd91d-d090-4662-b5a2-016a3eb700df", "value": "RFQ-EUF5089.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f56e182-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392715, "uuid": "e23c60da-aa4a-441a-9e3b-cae4ebed8941", "comment": "Malware payload (Mirai)", "value": "6fdc1bf02cb85ffc5ab5a68ed5e11b2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392715, "uuid": "57590f1d-dfb0-49ae-85e6-3c1ac7b9d8e3", "comment": "Malware payload (Mirai)", "value": "7905e13894f5fa0cd68a8d1261137a30fb73776acd16685d74635a7d49335b2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392715, "uuid": "c421e410-f606-4088-b73f-7db74402512c", "comment": "Malware payload (Mirai)", "value": "54a0b82a1e9bfd3e94ad22f1890eedafe5486e27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392715, "uuid": "befed25d-209f-4969-a0c6-58f76cbd89f3", "comment": "Malware payload (Mirai)", "value": "bd9944e251348e602b7d394e919b7e32c7689b4ea9efdb0c627dfd1f81420c7a00250a6d9eccd108d93cec8a8cf92509", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392715, "uuid": "ac9106c6-113a-4ec9-aa4a-d16bcae8126f", "value": "T17FF27D63C93B1E98D3150974B921AF3D9B63E559D6870EF5882682759403FCCF9182F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392715, "uuid": "226446e0-bd83-4a78-b73d-7b0b76258009", "value": "768:IUcpJajzZJdJ9JTCd+C1Mo7SoXSvQ8CQ/:IDp0jX3+d+yMoBXr8CQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392715, "uuid": "09b5e1a4-d9dd-4da0-a289-ffdad611e47d", "value": 34284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392715, "uuid": "0fcb4923-56d1-4e5b-9d76-3f86dc733e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392715, "uuid": "d8cf24de-d8e2-4094-ad57-cb90bfcf5d13", "value": "6fdc1bf02cb85ffc5ab5a68ed5e11b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d8436e-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392719, "uuid": "a5ac5214-1bb3-41d8-a305-1089120f3d7d", "comment": "Malware payload (Mirai)", "value": "ce73ce1756674c4e94d42a47bc34ffde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392719, "uuid": "15b47933-2e04-4236-9c32-a6ccdb78b2b1", "comment": "Malware payload (Mirai)", "value": "79638977d2d41e1b777396587285f9cfd079663750eef210f1be8a79cfa0f94c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392719, "uuid": "32978350-3517-4215-af83-07fda439e9e9", "comment": "Malware payload (Mirai)", "value": "73fe8283c811ac083e9c00b0ab903bb56a190b06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392719, "uuid": "12e0da89-4754-44ae-a815-b8f00de3b0cf", "comment": "Malware payload (Mirai)", "value": "742832ee05f7c9bbda7d124ef57215ca5ba4617e34edbc227c16004aef71352db03521e4fdd0b5fa9bb935e3db663def", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392719, "uuid": "c1918af2-c9a4-4add-884e-d956c0e1f15e", "value": "T15393B449FA64AB29C7E232FEFB4D028E332B1B98B7E67115CD315B4533C8B965535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392719, "uuid": "6949ba4f-c803-4c05-a778-121e80d5be60", "value": "1536:Swnz9gX+nbuA6IPS7/jXjea+8j4bA0GXo73gYcMiHzLC2lFyf0i6IBLGr2nnnfgv:xe+nSsPS7DF4Uu73gYcMiHgoIBL42n4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392719, "uuid": "2764da25-8e6f-4195-857e-bd8fc4552571", "value": 96420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392719, "uuid": "4208315d-f80c-4ef5-9b56-76a9a5debf51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392719, "uuid": "065d5a5d-00f2-4b98-8b46-1922f1e7fa32", "value": "ce73ce1756674c4e94d42a47bc34ffde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6378c44e-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691394762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394762, "uuid": "57dde006-77c2-476f-b7c9-a39fd04b7860", "comment": "Malware payload (GuLoader)", "value": "7110416f275f44deb346943d857fe422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394762, "uuid": "bf041bee-74f9-4a3e-90b8-1998fc8f8f4e", "comment": "Malware payload (GuLoader)", "value": "7966886e57a91a4fae3df27419c74cf088025a2cbe2d56810956ac6bb0712042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394762, "uuid": "0d36ded9-3659-4fd3-a9a9-b4d72582cc1f", "comment": "Malware payload (GuLoader)", "value": "ed5bf80716c45cfe2f3fd760fd84231bccd1bdcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394762, "uuid": "ce71d611-b830-45c5-917a-460715874646", "comment": "Malware payload (GuLoader)", "value": "79e959cc14c951bd74b0b4862c15b838d2cc32afe0a55b4022e1703750134fa45de839fa73bcb770ca448ff499a1e32d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394762, "uuid": "92ee17bc-59e3-42bf-aa45-a3a59e70d32b", "value": "T1C1B48D9279C976AEDC2F4678035FEAB22A755CE073C2496D4F40320D4C36A4A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394762, "uuid": "47e95df3-a051-4705-ae68-f63640eb2428", "value": "f5e6648dd4b477cc153fea2a49ce3e45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394762, "uuid": "bd253e20-a579-4d71-9411-772599c83f4f", "value": "6144:b5aSFdrqPZVheNA+ff00ic0wuDQlyI0tIrc4kCmauTWta4fs+H/haAwRtSZ/CvBJ:Xmnhe2eXicF0tHyYWI6souG/MBQab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394762, "uuid": "d4f8a6f9-db75-4277-b185-d5ccfba09fc8", "value": 511487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394762, "uuid": "3b37cd4d-9706-441e-b239-df5b68a85094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394762, "uuid": "7419eb27-ecd7-4b91-9135-956c41d5535d", "value": "1449S.23.EMMET.SR.NApdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3967f728-355f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691439359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439359, "uuid": "8c532885-40b2-4da8-b9aa-a2d4767f62ab", "comment": "Malware payload", "value": "d09a37f04c6529b00a8c6967ff235c93", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439359, "uuid": "f5d63e2c-e5bd-4234-9aaa-732879115441", "comment": "Malware payload", "value": "7b550a1e1e0c84212bf13c470fdd440c6c65801dea8facd9fcf47c784a45f1a0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439359, "uuid": "4a0dd233-0ee2-4fdf-8389-dc7d32eaa9f1", "comment": "Malware payload", "value": "d8f1f901d138c52770318b695d92fb744e98774a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439359, "uuid": "a0752070-f672-470b-97d6-2668f8981dee", "comment": "Malware payload", "value": "b360571d2a15c750bc941a71ace15ed1ad1151ed164850c5bfdb8608c8abff1f5ad396a23ab639e110231a335f660beb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439359, "uuid": "f52a6c66-7852-434a-b664-0af2d4ea9ca9", "value": "T167453377FFC1A2F312B0A874326A93FDFCAA12993B6D3911C21C9A85931055747217EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439359, "uuid": "012480be-bd9e-4a20-9f71-457fbc6181ca", "value": "24576:hpUszfQkggkUnsPaFq3d3hMom7rQiLZ0kVOe+Ycu5lBNS/hdWdVB/b:ff8gkUsiFq3d3yn7rQiLekVqYnNejWvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691439359, "uuid": "428a8ba5-85dd-44ec-b07a-80dbb79b1ca9", "value": 1171697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691439359, "uuid": "6aac740f-014b-4854-9cd0-2b4312a45523", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439359, "uuid": "120cbf46-dade-4bcf-85fe-1fb1d0882c3f", "value": "11407808388.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deab83f5-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691414296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414296, "uuid": "d972f45e-f749-45b6-ab33-ce8670541e6a", "comment": "Malware payload (RemcosRAT)", "value": "379f80b676bce36bfbb80299deb86f1d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414296, "uuid": "fa54f24d-6ad5-4e6e-9003-6eecfdf1bca0", "comment": "Malware payload (RemcosRAT)", "value": "7b9af60ca4de8ac1ec0bedc2852772bce1da4f821a1a1f570f8a413f22b9ef18", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414296, "uuid": "a8ee92ec-5b69-46e0-a904-2e3f721f3725", "comment": "Malware payload (RemcosRAT)", "value": "274086d7ed850c1cd22be70e6ff34aa5344e0b14", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414296, "uuid": "602d9804-0159-44c8-b742-925e118fb282", "comment": "Malware payload (RemcosRAT)", "value": "db19ec6fc8e205302eeb343c583d8a54419ce2fdcd46bceaa7fa4f34553ba5f6d114fc80fc873123d056cad6d67e8725", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414296, "uuid": "b1e5920a-3d85-43cf-b87a-8794a42afc31", "value": "T1F505E0039C499B43D06983F8BE434EAD1F092E1D98827AEF15527EDF3E706615C9E0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414296, "uuid": "e629afa0-771e-4790-bd07-83b4a1acdf6e", "value": "24576:4+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXqueixddoWXaXUxJlSd:N6qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414296, "uuid": "87100762-2ffa-4df8-a8ea-041f6f9cf3c2", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414296, "uuid": "65995b9c-b7c9-428a-a0bc-29e553eeac2f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414296, "uuid": "936db021-64db-4c5b-8295-06a3a5245a79", "value": "10939302023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96471485-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400431, "uuid": "9633f9ad-2c66-4dfc-90fa-a5b88ca66a9d", "comment": "Malware payload (DarkCloud)", "value": "ce7d68b1a60be0b5f8854655a50184c3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400431, "uuid": "5b3c1fe6-d103-4fe3-806a-9989e3c04d9c", "comment": "Malware payload (DarkCloud)", "value": "7ca236bd101c4d2b4bdfe2fc0b914e58ea1acf122cdf18c807a2fee4d96a28bc", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400431, "uuid": "eb5db774-419e-417a-88e1-053d9c5aae7c", "comment": "Malware payload (DarkCloud)", "value": "a742c84fcd6554517f509752ff3a77123a990d5e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400431, "uuid": "bef6a519-9cc7-47d9-ab96-ed25de914fac", "comment": "Malware payload (DarkCloud)", "value": "cafc311aab251e990a7c77b1d3c71d7e51640f07deb155c7327e42612a7652be986641b42aa291eebad61e0fcab3b63f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400431, "uuid": "a48d856d-0871-4c79-88c1-dc3dc70eefb8", "value": "T105844A12EA69703AF073C4F1AAB4922778196E362244E897F3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400431, "uuid": "24560840-ae98-4040-88f5-9fff21b97556", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400431, "uuid": "58732cfa-ae6d-469c-895e-524a9a7d7ea0", "value": "6144:Thys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:Thys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400431, "uuid": "966660be-202d-46b6-9afa-d0fac6846782", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400431, "uuid": "64e53aa1-c6ee-4358-b4b6-aad8929c1bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400431, "uuid": "9cf65e63-46da-4e42-8312-ff3fb75e9912", "value": "7ca236bd101c4d2b4bdfe2fc0b914e58ea1acf122cdf18c807a2fee4d96a28bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3185860e-3558-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691436339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436339, "uuid": "93ed593c-d897-4070-a570-486aa49fe1bd", "comment": "Malware payload", "value": "0122e27d69a899a47b4efbba8d2612a3", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436339, "uuid": "48fa562c-5478-48f9-94fa-ef2d0005cbc9", "comment": "Malware payload", "value": "7d90a8a3de4bbc93baa1f95b14f063f95b3d928075ed8545fe83572154f5c0c4", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436339, "uuid": "2b9dc659-3feb-4c77-b8ec-b75f6f5f8da3", "comment": "Malware payload", "value": "46e5747d56eac6054e242cc9e67769cb86b83028", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436339, "uuid": "cea73f5d-4939-4211-858f-6e3998b21fa4", "comment": "Malware payload", "value": "aa80695cff41dc5565a35fea261b056aedf131389adce1a4bf5507e74b38c89c036adc604779ad0babe9be44f0404469", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436339, "uuid": "8337d202-0512-49f1-a6de-d389bff3001c", "value": "T187C02B10411ECC35C02B4D084D0DCDBEE80310C1316BCDB4C7E0164CFC930399E880C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436339, "uuid": "94bf5ef5-c39c-49fa-9544-a9048ad44ed1", "value": "3:HRAbABGQYmimiLXIhzKEge0FHvUo1YSo/QJ7sIyYesbBSn:HRYFVmizLXczfaHvISoIJ7PyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691436339, "uuid": "6416882f-7104-4795-a786-36ae63c89d1c", "value": 144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691436339, "uuid": "d64fa56d-6a46-4b9c-82de-c9e7305e3863", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436339, "uuid": "09b4d82e-79a0-4ddf-bd98-2e13f89d42d4", "value": "en-winlocal-upd(download).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c75c471-355e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691439042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439042, "uuid": "d196a43b-148d-475b-8146-3a670930f18b", "comment": "Malware payload", "value": "b3f1ce9bfa31897c3742b716b113feb1", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439042, "uuid": "ce27f69e-87ec-40ca-8e19-4101fd9e987b", "comment": "Malware payload", "value": "7db48be79958304be379e6b8af6cfb4fafff39385c13808d236b15530bbd843b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439042, "uuid": "66339988-3e0f-4539-91ce-d77cd2be2460", "comment": "Malware payload", "value": "6272726eedf47a96b2ef72284c473c8df19f17ae", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691439042, "uuid": "b6cb1780-9989-41ae-9617-7a56f2af133a", "comment": "Malware payload", "value": "1c13634d1f7f1724c681ebb021dd5b78752fcc2eac05d1c807912f21947a93cbb3ba4b9cb815ecd46736beaa909ff2f6", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439042, "uuid": "b4ad2297-5fe0-4a19-a935-4f6f137dcf2c", "value": "T1E923CFE6E2491C6CDCD3CB76927A798D042E36778BDC7993B4740F2AA84C44875A30E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439042, "uuid": "64747b80-4ed4-4e74-85ae-300d6cb0e241", "value": "768:F6V0KG+hKi+Rtl6Ij2cNK1ky7JT68NPpW8AZtJk341CywqL3vJjX:F66bQa3lTqYPUJj7WdZU4Un63tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691439042, "uuid": "96f7139e-dad5-470c-a5d1-e0726b4ffeb6", "value": 45800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691439042, "uuid": "3893b9ce-1446-4e92-a66d-048568dac47a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691439042, "uuid": "0ed54432-26b6-4014-a68d-8cf73fa2cb66", "value": "washington-phantom-war-foreign-affairs.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9854a9-3538-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691422935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422935, "uuid": "acd1aa2d-fe73-4f22-bf26-b96f3de7b290", "comment": "Malware payload", "value": "ab78fe5e0d5d4a0325d5b7de414d7002", "object_relation": "md5", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422935, "uuid": "c28dd8a2-3487-48e0-8c6c-0644759366ac", "comment": "Malware payload", "value": "7dc76d43fbe3cd82ab536b2e8db21da49ba30bbe31b09c70caf442c6cbc3f897", "object_relation": "sha256", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422935, "uuid": "e4afe257-b66b-4edd-87f8-73f38811e008", "comment": "Malware payload", "value": "f3d338c0b109a0930c28357c0992e6bfb8981e39", "object_relation": "sha1", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422935, "uuid": "5acf130b-5e39-4156-8fc7-d95cdabb4749", "comment": "Malware payload", "value": "6df9cbca7c93ddbaf9c23ba9eca8a24db41f762d2e3ceaaac8cfdeb6012285114a4fc2df7be3209f960afecc0f64553f", "object_relation": "sha3-384", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422935, "uuid": "02d99f4f-3276-42be-b376-865c11aa7b9d", "value": "T1E0A27133316FF00F1095177A345817D268BBE54987CE890DFBCD8EA9B09E8DB2A586C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422935, "uuid": "9e6a94fc-e6ef-4785-96be-2c84af7a370b", "value": "384:k1wN/8pi+KSppJMwyUAtT/pgX4mGk4INFfJKlhlgl8yLcpcp7TDRI20gOMs7yPop:k1LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691422935, "uuid": "ea99b0bf-4bd6-45c9-ad68-0c8f7f786d87", "value": 23339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691422935, "uuid": "93325c06-4302-456f-8d5a-42916e0e1190", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422935, "uuid": "b435c5c3-9a6f-4354-a674-4534460d936c", "value": "tm63vBgu.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddff641-34e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1691386512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386512, "uuid": "4aa0ddfe-c205-4e0f-97ad-78cf304cea9a", "comment": "Malware payload (Rhadamanthys)", "value": "664bffe24693a7575ffcdaf2e33d6188", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386512, "uuid": "306840b0-d22e-4c83-948d-74e6594194b3", "comment": "Malware payload (Rhadamanthys)", "value": "7de67b4ae3475e1243c80ba446a8502ce25fec327288d81a28be69706b4d9d81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386512, "uuid": "4fd47828-6136-4d80-9b3e-f3db63f0e480", "comment": "Malware payload (Rhadamanthys)", "value": "79c46c28db3a8080c0739a0a6763ebee5b479e76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386512, "uuid": "b7631a64-1ae3-4fe7-8047-0a39798eaed0", "comment": "Malware payload (Rhadamanthys)", "value": "77c85e7ff2e8b57ba295c06f1caf18f8d95c49d39e17bb3c00506d55298765025f2b26b426e1a7c8ef7a53e724dbc8e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386512, "uuid": "e4f9a946-764f-4023-a457-72ca47879acc", "value": "T1FFD4F112C398A32BE42F6A38525F9BF653A27E30578159BB93807E3E84316C19D51F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386512, "uuid": "e08c9e3b-a68b-4658-9fad-77ba894ebe15", "value": "497393145c34e7a583c61d69d8db0bdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386512, "uuid": "99618d07-1084-430a-9fc6-70847a9f5f67", "value": "12288:2sjkDPRpsdgMGzN4wcZsHJHOa+YVFMKePHNPhaTGoXx4unuLT0Y9XEWSGqXUTjHL:2sjkDPRpcgMGzN43OHOKVF4vzErh4tfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691386512, "uuid": "6362956f-d0ee-4003-a35e-a388df04cd62", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691386512, "uuid": "6beba696-a122-42b6-8083-fb0383097de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386512, "uuid": "cd593c85-3225-490c-aaa8-64fe4ac59bcd", "value": "664bffe24693a7575ffcdaf2e33d6188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2abb473-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414705, "uuid": "8c5b6255-3396-4a8e-8f1b-c8a48943ff73", "comment": "Malware payload", "value": "53d2d2738bffeb8b0cd3748158251859", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414705, "uuid": "cd97614e-54f7-4f83-8564-99216e90d5d8", "comment": "Malware payload", "value": "7ebf6f9cf044ec02c37eff4cb5e411518085446eb6ff2e0a67bc64c5ba14625c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414705, "uuid": "ae32bb06-2ce3-4883-bc50-e7192b988936", "comment": "Malware payload", "value": "d694ddd62ab4e2598d95dac534caf31089fcd6c3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414705, "uuid": "4d60685d-bc77-449f-9802-3d4240c9fb9a", "comment": "Malware payload", "value": "df7912095ac1c04ab3200100aeb5c901df0ca3397df2a1d88165a9ef902db1512db0dc19a56cb6565f8a22166302b9f2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414705, "uuid": "d86a512f-e021-4b46-a58b-1bf98fbc0b82", "value": "T1C841020A23CA6F22E3728F729977F280C579B550FD53C79E429492C4986021CF8B5F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414705, "uuid": "3a795772-43bb-4540-86a1-ac792162fc2b", "value": "24:8L++oBJJil+1G2bAtOe+/rwfmpnCcct+/g11KTmOT4o0254zZlzZl:8uBi4lMta9xcv116bMo8z/zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414705, "uuid": "e7742cfc-728b-43f9-b729-8fb1bbe745d1", "value": 2141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414705, "uuid": "1c65ade9-64ee-4a55-a03f-8ecf6608dfb0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414705, "uuid": "d2b491e0-0981-4160-8bd7-14a8f3b3af90", "value": "Launch Code of Conduct.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e629997e-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691395411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395411, "uuid": "935f493d-1422-48a7-87d6-16aab74072e7", "comment": "Malware payload (Mirai)", "value": "7aa614be8527e2ae33541605410a7588", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395411, "uuid": "f9a7ac6e-b916-4b4c-8628-e81fab45b3cc", "comment": "Malware payload (Mirai)", "value": "7f299a02549dfec6984e721a2537b149959823d0385e27ea54e0959f447dc068", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395411, "uuid": "ed2a4bfa-9d8f-42fd-b036-73a246f2bfd3", "comment": "Malware payload (Mirai)", "value": "f3c980185362d550e56e3580ea26c0954f47dc6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395411, "uuid": "ab63c975-7691-422e-a8f9-38a44f2e8005", "comment": "Malware payload (Mirai)", "value": "1b9b1ae7dbee7dd93f1dcecf38515e0dec567fe8c442ca21446c15d3db6b87d44b38d1f12810d67af6f0ca53841a3787", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395411, "uuid": "33842a98-5450-484e-a6f3-ea3c8dd84bf5", "value": "T12C539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395411, "uuid": "d2d10800-76bc-4e17-a195-fc556dd0e113", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395411, "uuid": "7d3a6f99-cbdf-441b-8a7e-f546cf1c8899", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395411, "uuid": "c364ccc3-524b-4cd2-81d0-e5ca8dccce24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395411, "uuid": "58fefce4-44c8-4900-b534-73761f116df1", "value": "7aa614be8527e2ae33541605410a7588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9f6b4a-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691390325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390325, "uuid": "181e132d-768c-4a88-a577-d7714acb79ba", "comment": "Malware payload (AveMariaRAT)", "value": "a6126b47b321bb4d97983ab4cde1693a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390325, "uuid": "1f1711a7-6cab-4b83-b11c-c684c36c1c83", "comment": "Malware payload (AveMariaRAT)", "value": "80b8863af8acd5784472c84417e958a6648919cddc7be057ad875d09426bed87", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390325, "uuid": "c4c17085-aad5-4fd4-835f-cc4682194210", "comment": "Malware payload (AveMariaRAT)", "value": "02f7eebbe5b0749e7940120ad343b6c2490c5620", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390325, "uuid": "bc0b2308-70f3-434e-a736-e2cee4c322b0", "comment": "Malware payload (AveMariaRAT)", "value": "c5c6957655dce1d0b945586d7b09e21a3f2187caf3abc517a5382ff21cfb885d535c525036c3782eb63fde2f97b15c12", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390325, "uuid": "149f4daf-ed38-408e-953c-7b25f14ae0b9", "value": "T123342397F6AB1AAB8D73F0D196D2077D891708E09442DA3A5527253BE603F4873E83F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390325, "uuid": "ea576413-630c-47cc-86b7-9984d0fc1017", "value": "6144:MsTGjSn66mtL8+4rdNoJdD27KdadueH3YsSzMxPcuMcLe:M466U/oqd2KdZ6UWP5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390325, "uuid": "63b45cde-911c-451a-8a04-a08751687fc2", "value": 233532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390325, "uuid": "23b4ffc5-23f8-400b-8845-af2174841da5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390325, "uuid": "aa92a319-333e-4c0b-bcd1-20c146bece1a", "value": "new inquiry.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b6ce42-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691390384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390384, "uuid": "3b0a23ac-9a40-411f-982f-1b7b55b4f261", "comment": "Malware payload (GuLoader)", "value": "3524e10300f06bfba66a7506e7a8168c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390384, "uuid": "359db4fd-ce6a-4358-abde-1e806dd13bff", "comment": "Malware payload (GuLoader)", "value": "81482cb262dc16e1db35a5580bf0134bb618ec585342c7fd790accbdaddeeb6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390384, "uuid": "dd82454e-1552-4578-aa74-5cc659217342", "comment": "Malware payload (GuLoader)", "value": "7a58bab236ba2b83174687e05a47dcd15105d7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390384, "uuid": "e3fd5ee2-ff71-430e-b3ea-ea3180781c4b", "comment": "Malware payload (GuLoader)", "value": "a1cfd67403bd5b6a7112738b030dde633a92db14946089059023d3f44b05298534f3b99d4203fe73cc86ad4eb4b0b11a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390384, "uuid": "2e7afd27-5c78-47c6-920a-6673ba178107", "value": "T100C4F1B61AD3FB8ECC1E44358168A67E246B6FBC853159CEA651BC35A5F00421F0FCAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390384, "uuid": "d037761f-8955-40b1-9089-bf3e6518cc0c", "value": "bd1dc23681f44e733e87b20cf5b908b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390384, "uuid": "ffe68415-1674-4de8-8f35-2557452d49ce", "value": "12288:s81oDihe70ib0HpZ0DrTBcFjYoW4PZEPBBaP0+joOVS928biqU:jaH7L4H4rTzYEJsPJSpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390384, "uuid": "e9038b55-60a0-4598-82d3-7765f6225842", "value": 571320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390384, "uuid": "3dc41322-64ff-4603-82cf-59c2761f0a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390384, "uuid": "1cc0db36-b388-4c0e-821d-173826075bd9", "value": "Objectivist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f471b8a7-34da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1691382550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382550, "uuid": "6dc092e7-a507-4fec-8d1d-b5286eafafb9", "comment": "Malware payload (Tofsee)", "value": "d23526d5cd20f9798f82ef630510838c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382550, "uuid": "a5c333ac-f399-4112-9ca5-5d440c7876e0", "comment": "Malware payload (Tofsee)", "value": "81841275b53476b892ba3da736e05c01392b7f79f6fbb679fbb344f1433cc11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382550, "uuid": "78b5bfe0-a706-423a-bf77-8a70e73801c3", "comment": "Malware payload (Tofsee)", "value": "531bac0c65fd2209651295dab9e71085f3e2950d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691382550, "uuid": "bc68987c-2e9f-4fc3-b492-192f3d40701c", "comment": "Malware payload (Tofsee)", "value": "4382b4342752ef3be2ee817a78c5dd7d5f93880902531ee5a6dad3df4a8ada7d7b77c80d6b2faea3bd63c5033299d664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382550, "uuid": "3e40c176-6acf-4300-b2e2-81ac47f1942b", "value": "T14A546D1262E0A861E5775A334E2AC6E4EB1FFC61FF1577DB22587E2F09711A1C632702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382550, "uuid": "383d1ec7-4572-498b-bd11-770505efd6cd", "value": "f6429983d70ccd6d64f4cf8f0424f062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382550, "uuid": "730c596a-e18a-4c1f-95f8-61f46d927c36", "value": "3072:NoN2WdiJsjnhu+snkoBgaUCeboSuZXuPPdhVCe2TJXweU5VeNzGZ:qNWUnhuntvUISeEPNAJXweQVe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691382550, "uuid": "2a829e3b-8709-4e5b-9767-e959a23f67c4", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691382550, "uuid": "15850c45-2c68-4c60-a18a-744929714fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691382550, "uuid": "2e802772-b534-485a-a795-65267bf77c7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d183b2a6-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691414704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414704, "uuid": "caa05c70-7138-4742-82e2-b2cf12888156", "comment": "Malware payload (AgentTesla)", "value": "8b3b9ff05fcf5d03a85cbf2e3d1f1b3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414704, "uuid": "8ea82384-55ec-4d25-b45c-b39154849269", "comment": "Malware payload (AgentTesla)", "value": "825c914d1b8044d69a28fd70cb9eb16d4e8cef5aea5467bca537919f5de0ee5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414704, "uuid": "97b122ab-5fb9-4806-bd46-9339210cdddc", "comment": "Malware payload (AgentTesla)", "value": "0d83b38e05c765e9d70cf49e6d3acd0d2ee6f8d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414704, "uuid": "8fafd844-a77f-4fcc-b354-d9a0ef7810d1", "comment": "Malware payload (AgentTesla)", "value": "e8a0a09c3390dd2c5428d159eea3befd9ebf4f78b16132e5485fe27cbd3ae4b6fd230cdc65d70b0a2d6d5e8c2f15f869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414704, "uuid": "798c72ba-37cb-4ddf-8057-77f4cc6a2827", "value": "T1C3457013D77F5466EF25A3FC051F48F1B4F59C88E0E5E14913A6283AC4B93118D2FAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414704, "uuid": "31146e25-a1bc-4422-a994-44586f81f37c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414704, "uuid": "584cefb7-46cf-4330-838e-3e636e85d2d0", "value": "24576:ZXi6cpYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOuOgui/bIygLPIA29:vRs6CE3jLbO9Rs6CE3jLbO+uAv2PIALk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414704, "uuid": "7c8a77bc-6507-4c0c-9be6-8f65b13f6746", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414704, "uuid": "64de58da-186e-4fca-ba44-105c7940ed4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414704, "uuid": "82f6921c-0924-4596-9b75-6a29ce8e307a", "value": "FedEx Express SZVA3421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e17105-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691372454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372454, "uuid": "8a80f56f-ea80-4d19-9a1e-a334d0d03f79", "comment": "Malware payload (Mirai)", "value": "999d746bf64d8fadce837d822f02d40c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372454, "uuid": "c203a6a3-3ec5-4bff-8fdf-1f0681d998a4", "comment": "Malware payload (Mirai)", "value": "836d47f5287c7a47c6e3ccd5c03d9555f433190bb8bbc5c9677143c8ca33edaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372454, "uuid": "2fdd8176-0d75-4d9a-9213-819d68bc6f07", "comment": "Malware payload (Mirai)", "value": "1496ccbc232c62dd7bc53e06e264a6ef46e09d7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372454, "uuid": "d6566b40-04d7-4c56-b54d-f65a6de6d21d", "comment": "Malware payload (Mirai)", "value": "0cde87f7737a1b3dfd712de33c3986b349f4a9f9f0eef6cf2293169d34b6cc1eabcd314650eed99da986dab1c5aedc7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372454, "uuid": "07a5076b-fe06-4dbb-8f05-9fb751dacc47", "value": "T1F1D2E02CD51D7D05CAAE3E7E51CE55B9398CB0C0A35DE68E17228458B627E8BAC071F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372454, "uuid": "292b63de-9e96-4252-9ba3-cef89f49e969", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNu9eJbiWUT:1bDs06t4BEub4sU/MbUkemT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372454, "uuid": "e9c56b81-c528-4dde-aa97-706b72a7e393", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372454, "uuid": "2f64ffac-7bce-4e6b-aa10-0419f4478837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372454, "uuid": "e88ed05e-7cbd-4025-bf6f-97ad90ccd114", "value": "999d746bf64d8fadce837d822f02d40c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f48bc8-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691394770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394770, "uuid": "b7a06de5-550e-4b18-992d-9d5c3d81ee1d", "comment": "Malware payload (DarkCloud)", "value": "efc32f9fae7168916be229983266926b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394770, "uuid": "193fc137-4ac7-486d-8fcb-cd5a51276326", "comment": "Malware payload (DarkCloud)", "value": "83d500829f43f092f92aa54f4cf3d5cb9bcf390b27e06342cc6b387e5a626992", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394770, "uuid": "52936367-6eb7-4576-af6f-b9b67886fcd7", "comment": "Malware payload (DarkCloud)", "value": "5b0c20ec6f3bc14e7b4fe674deaa0a8de0593b39", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394770, "uuid": "d2e8bcba-3644-4fbc-ba42-260d669206b4", "comment": "Malware payload (DarkCloud)", "value": "82089032df15de6f3dd036fbd8dc717acaad81575a2877b2d4313683ac4a0f69a46b659c4d9d045a157ae0076db93d70", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394770, "uuid": "ab46b2f3-a7b9-4731-b204-42da0c14fe1b", "value": "T190A41816FA10712EF152C9F1E9D4D27768252D3611A8A8ABFBC15F4A31359D3A8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394770, "uuid": "b206123a-07c0-486b-82d2-587304e5b611", "value": "f04087517a52194138f935fd462dce1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394770, "uuid": "c474a231-a953-4f9f-91db-285ef392dd7a", "value": "12288:FSmMj6NRC7oI/ItgP2xAOld+P4GiRGdJjYKkJj6GmZU:m6NwoM4d+P4GiR0xYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394770, "uuid": "75e9de4b-fe18-4ee7-9974-8653952b9b07", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394770, "uuid": "8a6b3950-88a0-4c69-877e-23e284d1024f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394770, "uuid": "517ed310-f0b2-413e-9fdb-7849997c45fc", "value": "83d500829f43f092f92aa54f4cf3d5cb9bcf390b27e06342cc6b387e5a626992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e313b5-34d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691381591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381591, "uuid": "00b012c4-0a4e-4781-aea7-81478e6f7b37", "comment": "Malware payload (RedLineStealer)", "value": "64ad1673344278f2b5b557f3a0756669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381591, "uuid": "56c0ccb4-8285-4145-af67-fc83f7cab535", "comment": "Malware payload (RedLineStealer)", "value": "84c286184b95e0b070ef9b5dba2f347f0f009da781a5f75182629ee8286ac3f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381591, "uuid": "992fd4bd-21f1-42f0-8411-2685cc1b9a11", "comment": "Malware payload (RedLineStealer)", "value": "d22e810fed1cfcb8e726bbec8d5c30f25ad2078b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381591, "uuid": "6c9a1a50-42dc-4365-928c-c960e6d6efce", "comment": "Malware payload (RedLineStealer)", "value": "9810a13122c435090ce8473e732d7686221685a981178ce0800864ae59e1706dc08472c7a354fef758ce507b2694de02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381591, "uuid": "9faa99d0-a871-4473-a468-a5bce95436e6", "value": "T185545C1362906861E6735A338E2AC6E8EB1FFC91FF157BDB12547A2F09711E1C672702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381591, "uuid": "5791757d-2b58-4efa-ac94-8b6045a3716a", "value": "f6429983d70ccd6d64f4cf8f0424f062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381591, "uuid": "f9bf1ed2-9481-4243-8ce4-c11f0addf2d1", "value": "3072:LoNDtqJYjj5Wmg/Yf9ga5aIryAoBAPl2oIzemIklKyYEycG:sNmAj5a/2LxryBB0LIz5dKyYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381591, "uuid": "42074cc1-d065-48c8-b3d3-ef34cedfc479", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381591, "uuid": "be43835e-2896-4e62-b3d5-7796c483ded9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381591, "uuid": "d329d6cc-a9d7-4710-b901-b3d716f9f41f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbd2365-34f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1691392930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392930, "uuid": "765a39aa-07fb-48c3-8e07-95dd40c6b278", "comment": "Malware payload (ArkeiStealer)", "value": "160f84a661e72f2df1a45b16ad3c3bf6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392930, "uuid": "11b8d7dd-b31a-4681-a0ba-29c28fd7bda2", "comment": "Malware payload (ArkeiStealer)", "value": "8506490bd404c8b37462c5c04db5dc14fdc425dcb66fe4d6d2f3b669de115eb3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392930, "uuid": "4ace0439-c071-447a-ba63-31caacf3d8e4", "comment": "Malware payload (ArkeiStealer)", "value": "4afe69ddecb4c49d9116c3f786e82ad03294325e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392930, "uuid": "0f93e009-3254-4d2d-a7e4-867d628ff9e0", "comment": "Malware payload (ArkeiStealer)", "value": "5d82064bddfa03bed2f55c07bed2b8e5e76050bdc0ff36f006f432984cf3529200786b6666eae37525de51af235a3f70", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392930, "uuid": "b7524018-7df1-4862-8fab-dc6177c77104", "value": "T154A47D31B650C03DF5A201B69E3EFB66187EA870231555CBFBC50AB97EB42E15B3520B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392930, "uuid": "1c509a68-41fc-44fa-9102-80c4281e0c3d", "value": "2851f76e885446c55a9b6a41d8745a10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392930, "uuid": "1dae118f-1e87-45a8-9dbf-a5d29f085d5f", "value": "12288:6OnusA0w1/XDIGalOIL3wz44aA7YoQMBMcaW:A1/XDIGYOK32xuoQMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392930, "uuid": "27a28e4e-df15-4605-9fe9-3e33f03af616", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392930, "uuid": "64209045-6758-4df4-88f6-531be98f49a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392930, "uuid": "97a9de02-8785-4ecb-961e-981b8d7cb9ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033118d5-34fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691396748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396748, "uuid": "b1715c8c-b5f2-443d-a2cd-035e2ba42cfc", "comment": "Malware payload (Formbook)", "value": "2cbcf4f9a1553a42f33b0abfcbbcb7c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396748, "uuid": "664f6154-3a92-452c-af7d-704f3ad09011", "comment": "Malware payload (Formbook)", "value": "85bb4ef6c2c818c7ebd7efb8f4f49976a47f8850222526a4d83b30e19381c2ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396748, "uuid": "594281af-785a-44a7-864d-8878e81ed1d1", "comment": "Malware payload (Formbook)", "value": "590ee8dac40fa443942c25e74946061a0dcec8c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396748, "uuid": "74b92e7a-9b5b-4141-bfef-a7ec00514e06", "comment": "Malware payload (Formbook)", "value": "5e20a23fa2dd391ac43c9221fa55b3546fbedb62ed7cceee8c1265d7bedf6df80b63aa706e8896e0b9bc84556867dc6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396748, "uuid": "49bd9740-6149-4d3a-8d21-49938db21e63", "value": "T155F4263D1ABE223BC079D7B58FE5C527F01499AF3122AD65A8D787664306E5234C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396748, "uuid": "8b5a911e-03d4-4539-9553-ca28a5837153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396748, "uuid": "7b314712-3d6e-4a31-b84c-f18c522ec627", "value": "12288:JcUhBhJxeC4K0X4rLrX/Mt/Y8Om5//IqyAgidfNLUGnIlyaabueF:JcU/rH4K0Xa3/495//IdADHSya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691396748, "uuid": "dc3fdb62-669b-47cc-8934-6672de4ed721", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691396748, "uuid": "7ed73bfb-4fc3-438d-8540-99d86821a2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396748, "uuid": "4ae7a720-128e-4853-b6d2-cbfa447b2d69", "value": "85bb4ef6c2c818c7ebd7efb8f4f49976a47f8850222526a4d83b30e19381c2ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aa5c15-34bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691370008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370008, "uuid": "a2be9f93-398d-4ede-a7c0-0dad6a671faf", "comment": "Malware payload (Mirai)", "value": "e5c4f589c8b45e98aeec84f75e034871", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370008, "uuid": "89241c33-a458-4cb6-9447-085e36dbd485", "comment": "Malware payload (Mirai)", "value": "8714be0b7b1948c13941dd836717fa023a22aab547bbca305ce02d91a7536baf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370008, "uuid": "ea2abcac-15c0-4fc6-82af-7a54ddc09986", "comment": "Malware payload (Mirai)", "value": "45e64530db9b2ca52f5bfae49570ef88472f9a83", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691370008, "uuid": "6f0bcc68-e313-4864-9bf4-272530327cd9", "comment": "Malware payload (Mirai)", "value": "27c5737c13f9d504cef8af3e49679cd306d8a62a9e0b0c8458d98c52161413bec4ca9ec110011e329835dbd8bf98b0c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370008, "uuid": "143b5aa7-7d3a-4a87-b83a-0112f57c3d2a", "value": "T1A0C2E17092EE2CB1C6500572E6BC57C6BA434F7DE6FE3C90224087BB7982D1529E99C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370008, "uuid": "b1baefe8-904f-4af3-a4e5-75dd413c8b76", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEhAN0hymdGUop5h5:AWsoTAZ3alkXLvFh8nNEhAN0s3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691370008, "uuid": "a6d45bf7-ff12-4f77-953f-10f2cb981419", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691370008, "uuid": "e19e0ac7-9cae-479f-8be8-e6a361d12b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691370008, "uuid": "72f57397-e82d-4ba7-8f3a-2b515dc8afa1", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4e6760-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691414129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414129, "uuid": "9c642a1a-fbe6-4ade-9e27-dc6c8cf0b2ef", "comment": "Malware payload (RedLineStealer)", "value": "383502698a6390c20245f616778358e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414129, "uuid": "fc966b22-9a28-4282-9652-b12236aa7b69", "comment": "Malware payload (RedLineStealer)", "value": "89adc6d8ba1275e2de3434cd3c98382acb2a0dfe1b0f1eb5c802ac8a0bb6ba54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414129, "uuid": "216fe33d-3784-4522-addd-559c03236d2c", "comment": "Malware payload (RedLineStealer)", "value": "139c5c487da43525b9ddc2f9e6c9f6347ea9a85a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414129, "uuid": "00ef959a-b901-4c31-9d2a-7071b264c56d", "comment": "Malware payload (RedLineStealer)", "value": "5dd7106a66aef523a487d2cd8e593448b580c35fc5e760cf6e5b263745a0ea353c7d521f70378a18f66d2ebd450a8133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414129, "uuid": "12472923-9f1c-4802-9f07-591c1e6af098", "value": "T17D74F7E027D4689DC84E55F17C21352C97E1D446EA87FB23BC4BE0F8286A3C979463E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414129, "uuid": "68cc5d58-e341-4a7a-9b95-835fcae4111a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414129, "uuid": "44515658-8b4d-469d-b1c8-0cc90f7d2097", "value": "6144:VWnqu3GXTiRJYmq/I4GnbmcY1lY1Y1l1FgoC1111Y11GY1m1hDwVJG4WcvfN3dh2:qqQGXTUJYmNwJGpcvfN3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414129, "uuid": "30a3eb90-b8ff-4653-ba25-e320db261840", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414129, "uuid": "22576efd-b88d-40ab-b352-44a740014887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414129, "uuid": "61797a25-fd10-47ac-b50c-7635093f1989", "value": "383502698a6390c20245f616778358e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494fc86a-3539-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691423065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423065, "uuid": "fc629b94-3246-48a8-a7b2-51b615c7baef", "comment": "Malware payload", "value": "296209dec2624d996f3725fd39ba7eee", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423065, "uuid": "b1185438-9cd3-4cfe-9f0a-b2062e5f7ee1", "comment": "Malware payload", "value": "8aadcdab76adc16f776364f8e2d29f5e70d5af46c8a902b6da55e4bd6e9faf38", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423065, "uuid": "eb515de5-a245-440e-9027-acd76edd1d5e", "comment": "Malware payload", "value": "e32597847e90c9f1a4932c1e756bd9ee209bce8e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423065, "uuid": "0562252c-0358-4b77-ae29-b9a2cbba0b48", "comment": "Malware payload", "value": "4b4279225896ebaadede1946f9158e7dce9f597a2ab4a5e76a54f55447775f5f7b0b5095c22e38858159d73345842e3e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423065, "uuid": "781c0d77-3c63-43e7-a044-83144b4d901d", "value": "T1FAA3CF584F4A5E5F1E491A77382BF6CA24B09DDCE4CCCEBFB225EAF1B4D582C8025650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423065, "uuid": "024b58e4-8e43-4770-a719-d408c3262b2c", "value": "1536:xuaziIUPloyh0Fm+EwoG5hofDwzyZipmnl9MMl4flJ7e:oxIUHznGvofsCipml9MMl4bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691423065, "uuid": "96b4cca7-42a5-4111-b93c-97474b542609", "value": 105348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691423065, "uuid": "15e5eb84-447f-438b-9daf-d243d7103b5d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423065, "uuid": "361a77c5-3496-4b27-ba45-aeac0e19103d", "value": "nope.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18baa63f-3513-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691406663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406663, "uuid": "378750de-218c-4525-9120-8075f0a10b47", "comment": "Malware payload (RedLineStealer)", "value": "2f73da4b1050b285c40bda2a8772e9eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406663, "uuid": "0f3b64e1-5d98-438f-bb49-d2e3d0bb50d0", "comment": "Malware payload (RedLineStealer)", "value": "8ac453344783b80283ec9b7a8ef63a861d88d0fdf19ec90dba9f1c03fe4c840f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406663, "uuid": "06493f98-4751-4af3-8d94-136e2942a1f9", "comment": "Malware payload (RedLineStealer)", "value": "d4c1cde03c13bf207051d339e67fdb5870b3dbff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691406663, "uuid": "b376ed1f-e118-42e2-a7b0-63f878ac3b22", "comment": "Malware payload (RedLineStealer)", "value": "02554142c032f7f5c673d262c8349fda0f7c50cb516ae372c857ab2380cf12462bcf214116b84fc68be682ea88be2821", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406663, "uuid": "4de45651-b22e-4823-9d38-804946d98b8d", "value": "T114C4125297E89133E4B127B05CF927930E36BC926D24C66B33819D6A0CB35D8B97133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406663, "uuid": "581e8fbe-87ef-495f-b431-2e11f59bd839", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406663, "uuid": "63941aad-5f49-43d9-8a8f-3c4f35949cdc", "value": "12288:EMrwy90y2U/opSE167xtLwXRpgBYCIiZQMMPU3b:sys0ZnEXMzHQMMPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691406663, "uuid": "33eab662-93cc-4ff8-bf4c-00ca45a80d7f", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691406663, "uuid": "902887d4-3431-4f37-b110-096e7f4056f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691406663, "uuid": "31552639-0a38-4b25-b921-aead29e91765", "value": "2f73da4b1050b285c40bda2a8772e9eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f252cd-3505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400717, "uuid": "40998161-58f2-4647-a2d3-f3a9ffdea2bf", "comment": "Malware payload (DarkCloud)", "value": "847e79ef5e58fd50e3371e114faa3643", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400717, "uuid": "ed927801-c4fb-4c91-afee-0943a60ed46a", "comment": "Malware payload (DarkCloud)", "value": "8b1c413baffa778290948a71a8c2113e0bb0ac9e178e52bcffcd9e778d3110e9", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400717, "uuid": "8a07b61a-e789-4d7e-bd5e-eb28a7470d89", "comment": "Malware payload (DarkCloud)", "value": "7b014828a5f204968f49ad2b6e8f6d3559417996", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400717, "uuid": "bbe38f3b-85ae-469f-af8e-905de48dff9c", "comment": "Malware payload (DarkCloud)", "value": "603675c609860846c09d0970e726e25bb95f6142c3cf4106a7d3e3d8dd7f3841b0cd8a4d2c6948d3d179be068be92949", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400717, "uuid": "09cf4fee-709c-40dc-ac31-681e4b1664f0", "value": "T1F8844A12EA69703AF073C4F1AAB4922778156E362244E89BF3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400717, "uuid": "c3bdb908-65fb-4d5f-ba32-95602c9472bf", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400717, "uuid": "7c84da4a-7dfa-4e17-9395-dd996f988358", "value": "6144:Xhys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:Xhys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400717, "uuid": "9eb1f22b-9a61-4534-aa51-5b7af3fcbc24", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400717, "uuid": "8c98c8b5-c40e-4dd0-828c-3db72b6c8438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400717, "uuid": "362eee83-fcc2-4f31-be75-5c0316c7577e", "value": "8b1c413baffa778290948a71a8c2113e0bb0ac9e178e52bcffcd9e778d3110e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d36f74-34b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691367332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691367332, "uuid": "297f14d4-07e6-4ad9-9afc-036117d71fd3", "comment": "Malware payload (AsyncRAT)", "value": "20d87548988f0bfc6ec6f5d3fbe7b736", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691367332, "uuid": "a8da3eaa-e2cb-434d-8108-9534f777d1a2", "comment": "Malware payload (AsyncRAT)", "value": "8bdbc8cd68a7ec2d29f89042bfa03cf8250730ea9408453fe3ce99ea043774c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691367332, "uuid": "2ec3c532-4e57-4489-81ad-74b569c7df8e", "comment": "Malware payload (AsyncRAT)", "value": "629f00328c38116da5776100349652ed1999999d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691367332, "uuid": "9fb82b97-02e0-4f33-80c7-8d3f12fc7c06", "comment": "Malware payload (AsyncRAT)", "value": "7e8e33f5b4412c9649d6d2b7a9a262f20133b38d09ac9ad62f86afa9bfb5b9f60fe037f530182c452e1bc63ecd63d6a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691367332, "uuid": "be384275-738c-489e-9b87-86cbf4234bdc", "value": "T101531A407BF98119F2BECF746AF7A6554AF5F46B2A02D94D1CC801D90622BC29901BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691367332, "uuid": "3260cf30-a749-4587-9fd2-b6c829382b04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691367332, "uuid": "32c11b90-a588-4224-8b67-cc8728421f68", "value": "1536:ZL8O58JjigxoB0SnLjazwJbJQqJdV/uiYWBKXAx:ZV58JjtxoB0SXqubJvVWhwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691367332, "uuid": "92d2656b-7df3-4fcf-bc51-affbdb6194be", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691367332, "uuid": "a3f55681-ad8f-4005-a752-3e5e6aa8bbe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691367332, "uuid": "43854214-4b5b-482a-8f17-e54a1b83788a", "value": "20d87548988f0bfc6ec6f5d3fbe7b736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62afc96-3505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691400887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400887, "uuid": "ed7e341c-435c-4e7f-a2bf-a42b967ef500", "comment": "Malware payload (Mirai)", "value": "7e8784aacf9e86f3049db570e8adc0c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400887, "uuid": "ee9b47d3-d663-4fbf-a642-7d1117f135ab", "comment": "Malware payload (Mirai)", "value": "8c8f4b65f65068eed981486cf3839ef48be4c5c68afd2766d23d426e5346259e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400887, "uuid": "31a846b1-621b-4d5b-bdb6-5d3c36145a41", "comment": "Malware payload (Mirai)", "value": "3270106a7eba078e3bf77d49f8c9c7405d82d9a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400887, "uuid": "0a891374-2fe1-4d64-bc45-12442c36e0f1", "comment": "Malware payload (Mirai)", "value": "e96d67ad27f16eab0ba49b1f98aba3bc75ef2cd2df18f9d464c3a88c62a50428435d3411b5fbee907bc427cba5cd54fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400887, "uuid": "12178944-0df9-4794-88b2-71050d28a49b", "value": "T1CE334A02722C0A47E1665EF1293F17E083BFED9121E4F689694FDB5A8275E731086F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400887, "uuid": "d73e2eb7-b32a-4ddf-b9a4-99769863b881", "value": "768:A4zWB2idwjR5lqPJoENSdirrdiLDw/bp2TjchGyxfXCHf7dxAYbm:RqBVejYKENSdi4LU/N2TgRSHpxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400887, "uuid": "470f7487-fd11-4d28-8feb-35ebaa523cfa", "value": 54304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400887, "uuid": "97884791-cc34-4df6-b341-311f9b8695c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400887, "uuid": "19309fd1-1976-46d9-a746-eecc9811f1b9", "value": "7e8784aacf9e86f3049db570e8adc0c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c8745c-3516-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691408032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408032, "uuid": "81c04302-6922-4f74-93db-909f7fe646ca", "comment": "Malware payload (DarkCloud)", "value": "70ec1f119384c0b189b375da54b85242", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408032, "uuid": "dccc3c51-1759-454b-9259-51d60b8e9225", "comment": "Malware payload (DarkCloud)", "value": "8cb164fc56976ee211580e6ec868e4c3ad3a2726afb68c5fd70216860d5de27a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408032, "uuid": "eb7b6c99-790c-42ad-8944-a15d94a3950a", "comment": "Malware payload (DarkCloud)", "value": "67bca370f44d39cd8d14d2029807e3fe4473a35f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408032, "uuid": "1b5281a1-3cfb-4236-ba2f-bd90d1b5ad5f", "comment": "Malware payload (DarkCloud)", "value": "709fc408d63fa4d14e090ced9b7062aebafe35bd274e8fdf7cc101ca306c0863c1206b18f737adfbfe7ad86a48ce1323", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408032, "uuid": "237e144f-ff51-45b7-8e4c-4ca4c18b2426", "value": "T14BA41826EA51602EE053D8B1E9D5725B6C197E3A128CAC1BF7815F0931361EBB8F131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408032, "uuid": "d032261d-1c73-4b26-ad80-f03f403a78ca", "value": "5db1046eea14b6c304432c60b39abcfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408032, "uuid": "23877a34-08bc-4554-a23c-b32e259051aa", "value": "12288:SqHSgB/G5quP4QS3lt230usi1+iCgm0k/RNz8cjYKkJj6GmZU:igBBQqi+pj0kZ5Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691408032, "uuid": "9d710352-7cfa-4cf7-b931-48f34ace969b", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691408032, "uuid": "b295889a-8024-4a37-916a-8bd12e929b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408032, "uuid": "f7475ad8-8c3e-4417-801f-0b118a0d819c", "value": "8cb164fc56976ee211580e6ec868e4c3ad3a2726afb68c5fd70216860d5de27a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547895de-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691390442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390442, "uuid": "258c65e6-0c1a-4a48-9f8a-445304a56a93", "comment": "Malware payload (Formbook)", "value": "409558b1abcab78b81aaa19be34b188a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390442, "uuid": "28daf25f-4ac1-44dc-a0af-162f0dc03dd8", "comment": "Malware payload (Formbook)", "value": "8e67232bc9ae3eaafe5e648013868114e7d0bfe93ca0074d11ee7c9466bb2fc3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390442, "uuid": "4c0b174d-01a7-4568-b3bd-b9b94350c06e", "comment": "Malware payload (Formbook)", "value": "ff1166bd2842370172bc1bd0626af298ef72c6ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390442, "uuid": "7a188df6-767c-42d3-9cb9-b867c402e3f7", "comment": "Malware payload (Formbook)", "value": "e1f8e38ab0232f016ab3e6f77ff672ec4db2f5149bb82f453d5a36ca5166ad556c8dbbfb7f204b9d0b4a6e2466448dbf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390442, "uuid": "bd979857-1659-4d11-b082-9de771ce71c6", "value": "T1424422B0A1ED885C224F5DC39DAFCEA9014A28E54B832D558A10FCF73A47CD63972C1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390442, "uuid": "1a18d066-9e23-45e9-a5af-5d96758ce039", "value": "6144:LxdT0ZTNBXG7xKkLxmU5VPvy9rdKuByBdy3xDtU+1ymS1DI4hXBvQsW+syQg:VdgN1+ketWAuEu3tyX1DIuXBoXD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390442, "uuid": "a634396e-9d2b-413a-9f26-576b3f591e3f", "value": 254935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390442, "uuid": "a3239480-ca1e-42b8-ae2b-c4856ad989d6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390442, "uuid": "751f0f19-69e1-4f66-95df-f1c8aba4d847", "value": "Purchase Order-2130.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3bc2dd-34b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691366724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366724, "uuid": "389e3ae9-f721-4612-8fdc-27a2a87cf92a", "comment": "Malware payload (Mirai)", "value": "425be699bc9782a04f0af4c7a26c0cf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366724, "uuid": "05ab5dfe-eb7c-49bd-8ccb-4934e6f560e5", "comment": "Malware payload (Mirai)", "value": "8ed35d0f58cd8e1ea26098c34c00b4e96fe81ea55b171b6de933d1e9a38b2b4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366724, "uuid": "0aff2399-0102-4f30-ae5b-379248d2c827", "comment": "Malware payload (Mirai)", "value": "53b288d6d3b75141df307d066ff6bad94fa9aa98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691366724, "uuid": "3b88f149-106f-43c0-8517-36df91323a0c", "comment": "Malware payload (Mirai)", "value": "d01710fd0092d71014e3f3f3ace809f0c7376b737c83efe04e5ab7fdf70bf757a00ffef8a55a8672f6c8fe576bd58622", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366724, "uuid": "b26602ad-4ced-40a1-910a-8d6ac18e598c", "value": "T1B9539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366724, "uuid": "84b33cc0-20af-4ea5-9b10-8975015206a2", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691366724, "uuid": "76d8e0c9-7aa8-4f17-88a9-cbbe7bc23a24", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691366724, "uuid": "931acf9a-bdac-4cd6-9e80-269a5f732518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691366724, "uuid": "7ec28ff1-cb76-44f0-a5e9-e4b36e21d1ce", "value": "425be699bc9782a04f0af4c7a26c0cf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d161641-352d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691417917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417917, "uuid": "60ec0bba-2c3d-428e-9158-9c1f5cb98a05", "comment": "Malware payload (RemcosRAT)", "value": "9286304f3592ab2de2d549722e6869b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417917, "uuid": "301a81e4-c0b4-409b-adc3-53a460412eac", "comment": "Malware payload (RemcosRAT)", "value": "90199e919b753c405f76a253d0994209b7231e9f1927d9af81e6bc022f93235b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417917, "uuid": "637092e9-c8f5-4357-b528-b673b3d90e6d", "comment": "Malware payload (RemcosRAT)", "value": "fee5ef729c85412275c371da5d1360fae7a87e44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417917, "uuid": "d8c3c6b1-df44-4d47-adb9-36ccc74ebc10", "comment": "Malware payload (RemcosRAT)", "value": "dc1274974f068118cc38810b8769a30322f0f670264721f8a4bc408a8faa5c2bcfcc74cb46897242ae83374e3d8fded4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417917, "uuid": "d1d2a9c2-ffc3-4486-a89e-fe8ce6b8fa2a", "value": "T19D759C03BA878DF1D38BE7F6C59B50044BAAD681632BDB1FF98A335639037BA5841507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417917, "uuid": "069d1a8c-f909-4bdb-b27e-80e3c00f1e95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417917, "uuid": "7afde06d-a5bf-4c87-b0eb-10b5489c04c2", "value": "49152:MrS/XYg7k3aKoznVWeOYvsEyKbNWCpQf:MiXPjB5PFJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691417917, "uuid": "9568b70d-a6cb-4d3d-b19a-f4b8df88d314", "value": 1653248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691417917, "uuid": "d449c528-3e1c-46df-a0cf-94bb10a1bf70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417917, "uuid": "a0dfbd86-3cce-4b17-8348-e3f56d26cfcb", "value": "9286304f3592ab2de2d549722e6869b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0135e43f-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691390302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390302, "uuid": "75a2c474-38be-4dee-9967-b171fa088456", "comment": "Malware payload (Loki)", "value": "43ed767fe0351fe880c7ab6c6e0c296a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390302, "uuid": "2a977228-5fdc-44cb-b106-ef56271409ea", "comment": "Malware payload (Loki)", "value": "903e8bc85723320489960259f907195dbc38fe33cd5471b509a4655583dc02e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390302, "uuid": "20266f2b-3161-45c0-9f21-4f947fc4f2b7", "comment": "Malware payload (Loki)", "value": "26fe5e7dad46735a6813635b2c665ef87764a38e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390302, "uuid": "c1b9105e-c514-4a9c-98f4-948ca5171fa9", "comment": "Malware payload (Loki)", "value": "99eda0f69e00d7459339d77cf4e16b7bc41a35afbf1fb768af3b71083c3d71b719ea043a701bdb5fdc62a41c9301bc7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390302, "uuid": "2ed325e0-2c70-4eb3-a033-432918727fa0", "value": "T11EB412183A5CDBB0FCF903F7361C491D03F432A92275E36C5EA998E92866F5FA900953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390302, "uuid": "32641205-1000-4c65-8202-ae14146e721b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390302, "uuid": "50948503-acb5-4085-9752-5fb4dcc05741", "value": "12288:jK4FPJYpUdtTR6MhvriCUhLppO3aZo1H:+4FPJfdtTR9iCaLa3co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390302, "uuid": "6d548477-4256-4115-a23c-8e38e6aa5800", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390302, "uuid": "8dee3111-521e-4202-8bae-d12a18e59202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390302, "uuid": "bac6e168-90dc-4631-a095-ac6f255db053", "value": "J0370600140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6916f25d-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691394771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394771, "uuid": "e5821119-b12c-47d5-a664-107d7325c6dd", "comment": "Malware payload (DarkCloud)", "value": "aa403588aa11d6eb9bfd038975ece453", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394771, "uuid": "0311926f-9002-4b34-9545-3a9866d2b35a", "comment": "Malware payload (DarkCloud)", "value": "90a6877fa6aeecafced1257b2643924dd57c0e0ce4d4c4f06c34fad6b10464a4", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394771, "uuid": "3f9c8405-4fa5-4ce9-80bc-0eb29da23dc8", "comment": "Malware payload (DarkCloud)", "value": "d84e489e6c4c66f9250676c592dab942acac303d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394771, "uuid": "628c7288-253a-4f5d-97af-8a9c56c95338", "comment": "Malware payload (DarkCloud)", "value": "747ed3a7e7197d7818651fda39916b11c4a44680c85e284d82778527548172973d7ebaa2210b665cdd0c01aa88cbe06e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394771, "uuid": "d1cb3945-6682-4178-9ea9-615487724d3a", "value": "T1E2A42A17FA11702EF152C8F1EAD4D27B68156D361168A8A7FB814F4A31399D3A8F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394771, "uuid": "2fa29e8e-85ed-4110-91a8-63abbc4d20df", "value": "f04087517a52194138f935fd462dce1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394771, "uuid": "973dbbfa-2e06-4555-94e5-41135ef653f4", "value": "12288:fjvU8Z8gs+DoRbgR6peiuI1tFZFeLkUyO+RtCobMRhjYKkJj6GmZU:RZ++RG1tu+RtlMYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394771, "uuid": "b49164e6-262f-4789-84b9-03a3f6bb4827", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394771, "uuid": "8205b511-6a91-4c26-b828-c4915094a9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394771, "uuid": "ed2d1c35-d294-4bf3-9726-ac7c12bf7529", "value": "90a6877fa6aeecafced1257b2643924dd57c0e0ce4d4c4f06c34fad6b10464a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e2ab8a-3577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691449770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691449770, "uuid": "61551a34-b597-4553-88a3-bf3b99463815", "comment": "Malware payload (Mirai)", "value": "91cb9b29004cc8c5496bc951b6eb13aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691449770, "uuid": "6dea3005-320e-4c22-a0cc-2a51256acd8b", "comment": "Malware payload (Mirai)", "value": "90ab3f638244a81e76748186aecad1ee0585e68042f29b481ab38b195c5ab85b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691449770, "uuid": "57d0883f-8ab6-4bde-8870-90f9bad3a9a5", "comment": "Malware payload (Mirai)", "value": "c8a9fd4c514d13fa3c4fef6d06c97ea5406de500", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691449770, "uuid": "341da615-44dc-4b84-8179-9e5bc5c62ef3", "comment": "Malware payload (Mirai)", "value": "660af685d07c0d18499765559bbc22253c12807d555e2370e198901952e3bf8ebab42010206693f4d25798800550b279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691449770, "uuid": "96c81cc3-3ec8-48fe-9249-3cd81b92e973", "value": "T1A7E2F247014FC905C901E37B8A1708DCB971BEA21E9B2714EBACE07F8C704DEB29524D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691449770, "uuid": "fba2d9d7-b12c-4906-a505-f1cb058f9725", "value": "768:JvyXOqGqAWfcs+SAL4yUywcRjR6pSYU2PjW:JHqGM+SXyUyrkpSEjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691449770, "uuid": "ed1e7ec6-4ac7-4b76-9b99-18b7cf6b2e69", "value": 31680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691449770, "uuid": "f4dc706c-ffcb-477a-8d28-f8e8c777295d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691449770, "uuid": "ef05d6ac-d2ec-4134-ad87-fcd8594d16a7", "value": "91cb9b29004cc8c5496bc951b6eb13aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d469642-353b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691423823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423823, "uuid": "4002889c-731b-4ada-9900-16268f2c1ca1", "comment": "Malware payload (RedLineStealer)", "value": "46e16c5d1032be176da5549cc0472ed8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423823, "uuid": "b82df210-b3bf-4abe-a3c6-944930ad7e33", "comment": "Malware payload (RedLineStealer)", "value": "9277fad6d3622e65d29a42823e2d7dc65e5949b410d2724c29d895e9fc8ce840", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423823, "uuid": "efcf3ff3-1cff-4a7e-aa97-f82a39dc2542", "comment": "Malware payload (RedLineStealer)", "value": "e6de81b2a27a7cf89700479b57d4262006fe6169", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423823, "uuid": "5db98532-81ec-447d-aa9b-45610531bf1d", "comment": "Malware payload (RedLineStealer)", "value": "b8c6cb1efedf1ba740fe109a3fc9c27bc0f4dacb466891281307588beaf947559423ad0f0069ea4a707daca9c03a01f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423823, "uuid": "2bd328b6-a6b3-4422-b643-588b0ef35399", "value": "T186C41263A6D89572D8BE17305CF60BC30B3EBDA16C74875A2356995B0CB2B80B53073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423823, "uuid": "f5de1356-3794-48ba-8418-bc282b063a59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423823, "uuid": "25c3be8d-863b-409a-80db-c55cae49ae40", "value": "12288:rMr0y909nB0QiuTlIdMYMVp+pp/3z9cUFLC7vitpwyyTovnP5:HySnB5iupIiYIoppfz9cUZ3ETY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691423823, "uuid": "8730906f-49ad-4aac-9c5a-a586aa6ab8b8", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691423823, "uuid": "81ec62ec-1256-433b-8a7b-ea2b80d10856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423823, "uuid": "560607ca-fa3b-4116-9215-14e40b310237", "value": "46e16c5d1032be176da5549cc0472ed8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e647c9-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (a310Logger)", "timestamp": 1691400242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400242, "uuid": "e2b51dd7-5529-4b23-984f-4862943ea343", "comment": "Malware payload (a310Logger)", "value": "c84fa18b96495c6e841f4f51f13be99f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400242, "uuid": "48842a9a-ccfd-41bc-b40a-3dca9e48fbe9", "comment": "Malware payload (a310Logger)", "value": "92b2a58b647e00a887c4dba92d1e6d7ff4d50221ed19a618749305ce6be1c2ec", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400242, "uuid": "1e19b869-b7e7-46cd-9989-7b58888c41cc", "comment": "Malware payload (a310Logger)", "value": "3f02e9012781268a287f82d0f172e62da50a8f06", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400242, "uuid": "1e1c1c6b-7139-4117-9f93-a21a97094593", "comment": "Malware payload (a310Logger)", "value": "835affcbc5f4d961cc28ee5a458786cc6e2bf93cedbf3a66e3d0588668c1126c2065344ad26085a1c5c848f2b3266892", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400242, "uuid": "70d53f6e-fbc9-4739-bd43-c7fa522cfa68", "value": "T10A94011167B6F309D21487B513FB932401A0FB321EA74E0FBB0C6B5AA636D96E1B5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400242, "uuid": "e484a708-4354-4fd0-a0dc-189455a088f7", "value": "691613e5f161aece5d00ed0359fb7732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400242, "uuid": "5162b6f1-ca5d-4ec2-94eb-605ff58ab27a", "value": "12288:sWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmBcJ:3xgsRftD0C2nKGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400242, "uuid": "8291a1af-92b0-4efe-89b9-561282a7b2fb", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400242, "uuid": "6d534289-7b8f-4923-92a7-9070cf2172de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400242, "uuid": "0713cade-f7e6-482a-842c-ec58cc97221d", "value": "92b2a58b647e00a887c4dba92d1e6d7ff4d50221ed19a618749305ce6be1c2ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8047cb97-34d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691378919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378919, "uuid": "f8a7e6ab-4fe6-46a4-8ea8-ebdebf1b350d", "comment": "Malware payload (AgentTesla)", "value": "5706698f2b78183ecbfc38b12058c6fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378919, "uuid": "a17cf0d8-9da1-4ce9-a11a-a923169bb8de", "comment": "Malware payload (AgentTesla)", "value": "943b191de13abd6a2a77b3e84f61292f9e6a72eccd3ddea968ea93d2c91d8ee9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378919, "uuid": "96a709b1-d514-408e-a80a-64466b3134e4", "comment": "Malware payload (AgentTesla)", "value": "1e0668add25b24a9fad736d57c8fe5e1bbbbaddc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378919, "uuid": "6e8535f8-ca84-4d76-b1fc-97bc3c688980", "comment": "Malware payload (AgentTesla)", "value": "2defd6699e2e5a562db3620a3dee27c0879b38c6fe25a619b01449ae7f3370caf1c1178312fc4ed20ed658d9d0cd669b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378919, "uuid": "748c8ae2-396e-4d8f-8c0a-12a65177bead", "value": "T1F2151821E77B655AEE29A5F84E1F803239D6DCC0F1B1C598A7E7280389C23514E35BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378919, "uuid": "fab5bd05-ff52-45a0-9191-b00a3030a278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378919, "uuid": "30d327ab-64d0-4e79-a78d-bf29a8837afe", "value": "24576:51yYVtXt2PmRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOJOguRle9hCRh:51yYVtXt2PmRs6CE3jLbO9Rs6CE3jLbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378919, "uuid": "76770184-4dee-4b40-83be-d6d6437fe0a3", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378919, "uuid": "4d641e21-8691-44d7-a3e9-1da0df50db46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378919, "uuid": "3ded6472-ebb1-4966-a8f3-c5ea97db0099", "value": "SecuriteInfo.com.Trojan.PackedNET.2076.715.31677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d3d984-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691395388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395388, "uuid": "989fee74-9f25-42cd-89ac-e411911f12bc", "comment": "Malware payload (Mirai)", "value": "48bafa4091c72d19eff7edc3e190c409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395388, "uuid": "15614d15-91d1-43c5-8791-eb26cf177723", "comment": "Malware payload (Mirai)", "value": "955193c47c541dc6dd6fbc27d80d979dc47ccddaa2645351f6c5ed73eb096b02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395388, "uuid": "e049d616-500f-414e-9c9f-1620690e4d02", "comment": "Malware payload (Mirai)", "value": "9b9fe856cf6705fca58750557420caa58dc86de0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395388, "uuid": "4d67f4e3-0cc8-4eb7-8b91-6b5b42f74332", "comment": "Malware payload (Mirai)", "value": "1bc64d248e169d466301636f8f5c51b0ad754c30e85c3f2be62b21ea71b582edbe277d02fa69f5e3300008facbab30f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395388, "uuid": "73fb8121-ae8d-443c-acdc-8eb3e3868012", "value": "T1EAB2D1A49BD59706C270B475E27CCF925A3B05E4C6F63926272093BCD98145632FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395388, "uuid": "99e1c51e-36f3-4014-ba2f-ea38c238151d", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BLK9iAhymdGUop5hu7M:4C9KQFH0rs3zWoDDRsjt7LB9U+BdAs3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395388, "uuid": "49a964bf-c5e2-4cb1-95d6-08b014adba8d", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395388, "uuid": "a7413226-3fea-42e7-8f7d-082d80d61b9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395388, "uuid": "e46dcfcd-cd5b-449a-91e1-61c77f991b58", "value": "48bafa4091c72d19eff7edc3e190c409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c01977-3574-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691448401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691448401, "uuid": "0d72ba27-cee1-4166-ab6e-67e122ea0286", "comment": "Malware payload (AgentTesla)", "value": "a67c77012f4bbfdf309a897f2730c7c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691448401, "uuid": "f3df4f04-c7e5-40e8-8381-c8ef17211052", "comment": "Malware payload (AgentTesla)", "value": "95f55542b28bb67dca43e90777bd25700d3afea56b15581a8de5340d0b5dfc12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691448401, "uuid": "63fd6caf-7b28-47e0-8116-04d67c574d64", "comment": "Malware payload (AgentTesla)", "value": "72ce888ca1db575aa81dc6057620c60746ddaaed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691448401, "uuid": "fbebe4a9-477a-42cf-8fb3-23f4c189077b", "comment": "Malware payload (AgentTesla)", "value": "4bd6c02905bbf4316a8fedf248160b2cc80c60e831e8b702cc0f4ada1c7435e9790dfafcb4e20c70838dec463045645f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691448401, "uuid": "bdf79b39-5a5c-4d01-936b-176b9f1ca0e1", "value": "T16134FD037E48EB15D6583D3B82EF6C2413F2A0C70673964BAF49AFA529512436D6E33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691448401, "uuid": "b3897bc6-3bde-4c10-8edc-b143ca2a28c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691448401, "uuid": "ce09e055-0fe8-4ab0-bab8-b347940fd80a", "value": "3072:GklZYqAquQljiGxYivmbRdaVeBwv4eR0GhdjhmUZzN2Pfu+:V+qTFpiGxYiub7wvQYdl3qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691448401, "uuid": "bb52c86d-8fba-43f0-911c-de7f8ffadd16", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691448401, "uuid": "bc3dc80f-51ea-4b94-ae4a-4e776d62d555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691448401, "uuid": "4f2ed82b-fe31-4e61-8cb3-6d74b0b7b3dd", "value": "1691448399f42719b8bfe4effdbd9b228d121fb2cb5332919e6745209ae8c43aec85976a9c559.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122f6508-3510-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691405363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405363, "uuid": "a0df5426-2448-432b-a423-8844092e004f", "comment": "Malware payload (DarkCloud)", "value": "d3dbb37d46370f5e90541d073e370639", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405363, "uuid": "cc1d0bf3-bf11-4d0c-97cf-6eac5382dfbc", "comment": "Malware payload (DarkCloud)", "value": "9650d6c845801163fdfb37c0197340331f74cc389c520baa850c0b6cd66ab70e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405363, "uuid": "ab09ab4b-05be-4497-a46b-a0b2f6af5951", "comment": "Malware payload (DarkCloud)", "value": "6bf9caa630aaf1157d3988c7400a4c366f53b02f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405363, "uuid": "7ca2e362-e96e-47f8-9cc8-290b58077cb8", "comment": "Malware payload (DarkCloud)", "value": "d7fc2fd46c6b71cef545c616e668ecc4b5a4ed55f47bd37576e095c3126b674eac75711ed95955643fc1ed7b8fca4fb2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405363, "uuid": "15a709f8-d6a3-4dbc-8743-8ed1d44175dc", "value": "T175A42926EA51602EF153D8B1E9E4625B68196E7A169CEC2BF7855F0831312D3F8F031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405363, "uuid": "89fe0b84-a73e-4703-adf9-0dfe8dd5d636", "value": "46dde7a8d2b198890050830beaf551ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405363, "uuid": "cd5766c3-7ca5-473f-894a-a89f50cddaa1", "value": "12288:ShrJddndm3AsXQJDKEKBBhtQHlfy9yECnjYKkJj6GmZU:anwLNBBhtQH9/Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405363, "uuid": "aeef5f8d-b5ed-4bea-a634-518aa1c62313", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405363, "uuid": "0d9494e5-2f35-478d-add2-74751375833e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405363, "uuid": "0c0d8e07-c8a5-4dff-aff3-214fbfa8a801", "value": "9650d6c845801163fdfb37c0197340331f74cc389c520baa850c0b6cd66ab70e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bb61ff-34ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691375524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375524, "uuid": "d67183f7-185b-4af5-962c-81d9799b81f5", "comment": "Malware payload", "value": "753b46e41f84b392bb07139a4f9fdb26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375524, "uuid": "21c31ea2-cf81-4fdc-a7e6-268b07d6edae", "comment": "Malware payload", "value": "96d5f58800c2fe23a47f080b46126cf90b6d3011aa51d0054ce1877d5b0f8745", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375524, "uuid": "f968d5e3-6e92-48d6-997e-cc0384289649", "comment": "Malware payload", "value": "5939ad9ec82a64aad7ebaf2c4b60a0f2041ded41", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375524, "uuid": "a8dfb85a-4975-4bc8-a2c0-016d8b54c119", "comment": "Malware payload", "value": "23f5ebfc820be04c857edd55a937b5b9b6d688550454c0134cfb162cdfc284388b956568a8b80f291df71bcba49397fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375524, "uuid": "8f7a41bf-f23f-4cf8-935b-c70d24399a6c", "value": "T188E55C30E751C01DF9EB00B356FD56BD58287A60479850C761C86AFA6B3A7E27E3234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375524, "uuid": "1b1d6b43-c8df-4599-98ee-64d051320b0a", "value": "2163651762377fee755a98b374ea8507", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375524, "uuid": "9a1a22fe-09cd-4d58-bdea-f8d57e242eab", "value": "49152:kf8WZ2h76NyBwn/XcB1YT+315Lo20sJ/WQ+dyBajRY5TOT:e8WZ2h76NyBwn/Xe1G+ssJuQbaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691375524, "uuid": "f427535b-9073-48f6-a487-d9c3835bc077", "value": 3192320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691375524, "uuid": "15e11fd9-f940-445c-845e-3010a7ba5907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375524, "uuid": "59e31c97-f6b2-49bf-9f2c-72049cfabbe1", "value": "SecuriteInfo.com.PUA.Win32.XchouWallpaper.B.component.8548.4385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e40dff-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394773, "uuid": "f900bf8e-b759-43d4-8225-cce744ffd6c5", "comment": "Malware payload (AgentTesla)", "value": "d852a371222e4dd8c53d1fd35467e7c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394773, "uuid": "f3c0ba72-dc19-4775-a6ed-98d7ca0c562e", "comment": "Malware payload (AgentTesla)", "value": "974ca7ad435352579a6080a0437db8fb96a3cc0627799820cbe3aac2fd0a6a0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394773, "uuid": "eb7a589f-c419-435d-9208-d090ac878218", "comment": "Malware payload (AgentTesla)", "value": "7a1be984fb76055e1df0814a6978a17d98c04e92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394773, "uuid": "fe40bac1-2955-4544-8638-033e1318b34e", "comment": "Malware payload (AgentTesla)", "value": "81fed85d7e74d3936944f852ac64ab8073e2cb20eb9a80902c5d01693e5d2d9ed3db8e955e03be475a4803dec059bc04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394773, "uuid": "2b33d287-0666-42c2-aea9-11121d44f044", "value": "T10834FF137E44EB15E69C3D37D2EF2C2413F2A0C70673860BAF89AE6529416436D6E36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394773, "uuid": "31cb528d-4901-4a18-a16b-f162cbe92190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394773, "uuid": "277a3c09-4517-4e47-97c3-7d55bd6a6416", "value": "3072:LCTvcpeSOux0y4ssBXrVqAckc+7TmAxVBQau8o:WcQSOmAssBkvKTm4r3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394773, "uuid": "000ad06c-521f-48a8-b99f-e994b0826497", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394773, "uuid": "82425a55-85ad-4441-84c6-525b8b9930a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394773, "uuid": "ca1aa33e-507d-47cf-b348-4a3a30fc3a8c", "value": "974ca7ad435352579a6080a0437db8fb96a3cc0627799820cbe3aac2fd0a6a0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcef8d8-34d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691381730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381730, "uuid": "9a5ec884-f9ab-4c9a-8c4a-16fbd0dd588a", "comment": "Malware payload (DCRat)", "value": "291364d570abb809fa2d2c5c223a6fee", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381730, "uuid": "ad69f139-f72f-4b54-9229-e1f680636187", "comment": "Malware payload (DCRat)", "value": "97d09012ad0904239a5999e32d735b70b847ab048baf1fedd2342d8090bc82b0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381730, "uuid": "6f36a452-8f0b-4a56-a1ae-ebb6d3e15c04", "comment": "Malware payload (DCRat)", "value": "8cf998193dfdb00ecf3014ec172d7f1cae8b14df", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381730, "uuid": "097c9754-dc66-4dcc-ac03-191435ada2a1", "comment": "Malware payload (DCRat)", "value": "a8cd4cfe58abc5117ed955ac46c05488c036a273026c2dafaaee43ddea1dd8f59935c601b7ba429e0f8dbdaba107509b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381730, "uuid": "f0d67c9e-c58d-4d53-8b69-2a2c10a6ccf0", "value": "T1E3B5C0427E44CE11F0181A33C2EF55488BB0AD5166AAE72B7DBE376E25123973D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381730, "uuid": "ecfffd5d-01b7-4bd1-adaa-1950f200136b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381730, "uuid": "16bc5c3b-b96b-4f94-9a6f-7b0233abc917", "value": "49152:mL9xrth3uBgGzEETxkc9yE+F/61DQYSoDFm0vdD7H:mRHJuu8/9kC7+V6E0BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381730, "uuid": "61aac1ae-9a71-4211-ae95-c1995fde905c", "value": 2403328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381730, "uuid": "3bb1d4af-c3f9-40b4-adef-39a15ca5749f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381730, "uuid": "a358345f-0597-4b79-a371-c0054233b101", "value": "291364d570abb809fa2d2c5c223a6fee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779a7c83-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691394796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394796, "uuid": "85f901fe-d10a-40dd-ad5f-3e6f39e4b108", "comment": "Malware payload (Loki)", "value": "6b03a36b916a9bed68f00a286f4700c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394796, "uuid": "78699445-97bc-4a5b-8b7b-feb871bbda64", "comment": "Malware payload (Loki)", "value": "97e9f2a76443873917d904787cbbaab7b493dd14a0ac6ca6533f904f3c067d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394796, "uuid": "81c28bbe-23f3-4516-9d2a-f195de5b6f05", "comment": "Malware payload (Loki)", "value": "7f06899c2b9c0a532c5106ebd4a42b4319e2555b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394796, "uuid": "4e348b35-e35b-4358-912b-ecaad75a02b8", "comment": "Malware payload (Loki)", "value": "e9ef7ae2a0197495cc51b861c575d5022ba9e3421576e9cf99ecf1a70cfd24c02bc9b6168073a6e5f36965c2b12b65d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394796, "uuid": "d63bd7c4-5ab3-4bfb-ac62-23d4536bfde1", "value": "T1E9D47D7406A6C60BE42B1734DCF3E2B53FA98FA4A2E2C7474FE47CFBB44A0556691094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394796, "uuid": "95ddbb38-d7ff-444d-a277-69bc272d2ad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394796, "uuid": "d9e6015f-a815-4b70-9932-4941a4024442", "value": "12288:T00BhpNkJGTNe6hSg+LQqRTJhfBwMo03eYaM:TJBZkgJxhB+0qR/ZwMl5aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394796, "uuid": "65091c94-b2e6-41dd-950c-5291e6523fe7", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394796, "uuid": "f7522869-0a4a-4ad0-befb-99a2bec61aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394796, "uuid": "9445c2b7-1f63-4e2e-95c5-5d73660cb1be", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da41c71-34e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691385330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691385330, "uuid": "c980b26c-524c-443d-9b97-c4eed6d402ec", "comment": "Malware payload (Amadey)", "value": "a05e9b43519fb7192b88d8510d187365", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691385330, "uuid": "5d49c65b-f4d0-49a0-aba9-a549be443550", "comment": "Malware payload (Amadey)", "value": "984859ee65af11800a85563fb0e146c742f13c8d5f78eba7f3e27ab06ce573ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691385330, "uuid": "3ad9b95b-167a-443b-973c-661d7eb90320", "comment": "Malware payload (Amadey)", "value": "02730af483b1589923b093a1f9ec6556667eb5cc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691385330, "uuid": "5de9976b-b204-4622-a995-59c2c24ada50", "comment": "Malware payload (Amadey)", "value": "6ef19ef719962421f9a5bb6b7d485c96a78273e10a758fff465ca88a78e3233e19c366c2b96abeaa7a595a91dac435c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691385330, "uuid": "5d1dcb40-ada4-4b4e-9014-828c0d0d0760", "value": "T184C40213B7D880B3C9B157B018FA03D30B35BCB19A74975B2695596E0C72B88B97633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691385330, "uuid": "a616ddbb-d420-448b-ae3f-8eeddd06dbf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691385330, "uuid": "12151d7a-e28e-449d-a65f-11a96e78ea6f", "value": "12288:uMr+y90KWjj6d7m4d5owXtuyHyr04iOo6HnNA0rQ:0yLq6NoTIyI4ro6Hny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691385330, "uuid": "813e8acf-d890-4a14-8249-76b5c140c622", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691385330, "uuid": "a01f2214-020c-44a5-9263-b807125e655b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691385330, "uuid": "c670a59c-3b8d-463e-8c2c-3d67ea317551", "value": "a05e9b43519fb7192b88d8510d187365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9f24f8-3537-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691422181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422181, "uuid": "87fb52f4-be4d-43c7-bdd0-6f7932bb709b", "comment": "Malware payload (Loki)", "value": "e0f10c4abea2b78b8d88448b02e7a7d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422181, "uuid": "a77a032b-1b7b-48d4-b79b-4133b4db6d30", "comment": "Malware payload (Loki)", "value": "98effda4841c6c1b722a51086b614c9a5c4c779070ec34e5427d0416240cdc5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422181, "uuid": "017b63c6-5ad1-4ace-b181-ae2bd179b1ff", "comment": "Malware payload (Loki)", "value": "cc72af254699fe687891c255d249aedac44209de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691422181, "uuid": "b58fd587-8ece-481a-aa6e-3acae94c2ade", "comment": "Malware payload (Loki)", "value": "98051fa0691251aa2fc19858393e791d5ba90d1223dc51460b8d01b6d1b6b80c903fd0a843f675feb2d2162c100e0cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422181, "uuid": "36e838e6-105a-4d7b-b38d-5e43775d2378", "value": "T128D47D7806A6C50BE42B1B34D8F2E2B57FAD8FA092D6C3474FE87CFBB44A05666511C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422181, "uuid": "ab64c70c-80ea-45fd-8e29-11bc960c772a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422181, "uuid": "cab026a9-1ab2-4563-8a7f-164727cab87a", "value": "6144:ItT+iT+Vyp1I2RgNn28WpPdMTtPHA9cUljRPLlqAKIvGp9w/CRjaFrzCCX+T+:ItBJpNLldItfA9cU/ZqfyGPw6ha7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691422181, "uuid": "12927002-989b-43a4-8b8c-f54cc65e5ebe", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691422181, "uuid": "22ca6b0f-c5ec-41c9-a35b-3e2a3dc9cff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691422181, "uuid": "6366b9b3-c1f1-4338-8c0c-cf131b37823c", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b74f414-3500-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691398587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398587, "uuid": "dcfa8cb2-dcd1-4f41-a77a-8da733dcbdfb", "comment": "Malware payload", "value": "a62d37547e00fccd07d9d70e06bb2714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398587, "uuid": "9f40f976-f2b0-4a54-b37d-ef6bb7222696", "comment": "Malware payload", "value": "9a47498d6cca04174397628bd83a00ecf809d4d58d8c523912b8a85586f87658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398587, "uuid": "23816df2-8e10-4a5c-b5d0-23cb684b44b1", "comment": "Malware payload", "value": "1be1a813d695ca505937b41478267a0e3bec03b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398587, "uuid": "d6ca509a-2045-435e-897b-128366fc92e3", "comment": "Malware payload", "value": "cec40fb8c6b10767ff377e490ae36f18ab2099f0178e5cafa87232b3a34317b82109f52e85d523774f45738d2bdf38bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398587, "uuid": "673cd71a-c7cc-4a18-9ba6-8bf21490c7d6", "value": "T1E7B40626E721702EE1EAC8F1E6E8526768146D761198EC27F7815F4D32352D3A8F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398587, "uuid": "7177d6a2-a84f-4b4e-bc89-83da01dde1af", "value": "e54239e86b9cff7ce74afec114ce6400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398587, "uuid": "e1f488f3-312b-45c7-b06b-993408a6d8b4", "value": "12288:296BEnIHYA+2t3xny0I4d2Nqnp4vRqMr/jYKkJj6GmZU:VB0ZAcTInp4vcEYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691398587, "uuid": "9f9f3168-cfbb-439b-b05d-b77add14b731", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691398587, "uuid": "c2780866-48ea-4e10-bb1b-3fd3ce6d0b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398587, "uuid": "e85511e4-8015-44b3-b6d6-940f6c90f49e", "value": "9a47498d6cca04174397628bd83a00ecf809d4d58d8c523912b8a85586f87658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5ec21c-34d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691381248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381248, "uuid": "558b9d09-0611-4870-a3ba-6967a75106a8", "comment": "Malware payload (RedLineStealer)", "value": "0895ce27dc1c490a255f9e482c2860c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381248, "uuid": "91a42d39-8b34-4fc9-a90d-df460f89cdb0", "comment": "Malware payload (RedLineStealer)", "value": "9b400556890eb898227a06f91838ff0edf22c19a5f06d5f99181c7da2c45ea07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381248, "uuid": "f58a0557-57f2-4d01-91c7-9f9cd69ad489", "comment": "Malware payload (RedLineStealer)", "value": "7b3e1719976430ef35e9a87cc1f3d25d1f204402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381248, "uuid": "e2394b2c-8a79-47ed-8c6f-f6c1c194bd26", "comment": "Malware payload (RedLineStealer)", "value": "fab820175f0838b0a06b38fcba45694c5e097acb42b55122ff1c57f8190089188ca3811a8a7352e684979d3fa685f730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381248, "uuid": "2c19eb25-c4bb-41b7-84a9-ba1c3bd828ee", "value": "T140849E1362D46861E6361A338E2AC6E8E71FFC91FF1577DB22587A2F09711E1C672702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381248, "uuid": "09cd133d-e2de-46ce-8e6f-ea9183502d38", "value": "f6429983d70ccd6d64f4cf8f0424f062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381248, "uuid": "cb49b74e-999b-4a42-8184-b0c320e86109", "value": "6144:WNosHpxrgdQCehYroroFzWxv7OP8DHLYv:MoSp5gi4ro8cPDHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381248, "uuid": "f0f153cc-9a09-4bdd-9b81-ca733ff6c9e1", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381248, "uuid": "24365996-0f96-45cd-9183-f96367c8f8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381248, "uuid": "c5678ffb-f2ca-4335-b490-ae203a0b9285", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0527ddc8-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691394604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394604, "uuid": "0b1c583c-c954-45d7-9246-fd3457186e10", "comment": "Malware payload (Mirai)", "value": "0813ed7b3dc33ae3a18761ad4f33173b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394604, "uuid": "74d0d00b-0b6c-4d7c-a565-56017e00ac18", "comment": "Malware payload (Mirai)", "value": "9eebd58ed9e7d2673b9705d28d868c032cba2084a7c4722a6ca7f9952530e6d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394604, "uuid": "7d3268a5-919d-456c-a872-994219a90e18", "comment": "Malware payload (Mirai)", "value": "fd21e8edb24835b479629b55bf28b89ed631b465", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394604, "uuid": "b17118f8-7138-4fef-ab56-28be4a5778a6", "comment": "Malware payload (Mirai)", "value": "2a7c228491c841842ba3dff002b5f174b478c63806fcd0ecf48330c8f5e499cad3ef743c031de4bb433a6b2ccf56efba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394604, "uuid": "22a08f92-b056-442b-9d9f-e0714fef480f", "value": "T1A8C2F17FBAA96A67FA1C333EE035811B03A5F51C97AD276B23404132E94E41D7532CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394604, "uuid": "c32eda94-fcbe-44fe-a9b9-f526da34e961", "value": "384:M21DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHb4wIKD:vMwxdyoEUnDz+Y8tqHWXm74eY0N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394604, "uuid": "99fd7966-ec83-4c72-8e49-1bfc7cc6016f", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394604, "uuid": "b0ede229-f457-477f-b317-3bf7a17705f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394604, "uuid": "efd99f71-70f1-42af-b94b-02581366033a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a91809-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691394789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394789, "uuid": "b4f1c910-12bd-4062-ab99-e488e070d773", "comment": "Malware payload (Formbook)", "value": "0826fb901788d60580e31f36a3a783f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394789, "uuid": "9529526a-45dc-43a7-b130-553ff0eed3dd", "comment": "Malware payload (Formbook)", "value": "9f1a40dbd475823ce6ab1cf58e325e04a0d0109705a4684893f6db2ca17d2875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394789, "uuid": "80c4834a-fcf1-482a-899a-627cd9c421ea", "comment": "Malware payload (Formbook)", "value": "2a0ae1b1d8d8d9b97e578f7b8d144406c8e842b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394789, "uuid": "c204e900-a925-470c-8b03-adfd72c39f9f", "comment": "Malware payload (Formbook)", "value": "937051e97571bf765a844eb5ca98f1769e57e88c0e73dfe4b733a73b4d8d0f0116a612c2ced438ef60f166a3d6a5bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394789, "uuid": "a892020d-c469-471d-8f97-4ff9e087587a", "value": "T1E2921914A61C9163CAED4A7D549317A603FAEA27F893F74F4FA0E4573A933C589012D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394789, "uuid": "177ba0fb-d195-4507-a682-066ee4b2ba8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394789, "uuid": "66d2dd24-ae67-4958-9bb5-0a83c1de2740", "value": "384:txwJkRd/kTEgin3Rt9Tffvsj7ACkc7W/kwQaFQwRemYI:XV/ainr9mV7gRTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394789, "uuid": "ce58799b-4771-44fb-8944-4c849863bc7b", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394789, "uuid": "5b31c36d-0bbd-462a-995d-5d8864135b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394789, "uuid": "36105c9d-e8bb-4fa5-bd3f-e4e2c6c4aeb6", "value": "mahfamjam product order description July 2023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5066e76a-350d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691404179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404179, "uuid": "f79ac95f-170f-44c7-a52e-3c329e0af266", "comment": "Malware payload (AgentTesla)", "value": "1133c761791613482cd5fa9794fa7554", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404179, "uuid": "a1f443d1-077b-44e0-b398-a909330ee008", "comment": "Malware payload (AgentTesla)", "value": "a04c81628459c1f127ababe2bec1e27fd2249ccc313d5e02adb96971d6c7c1b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404179, "uuid": "922c050c-fa04-4f4c-8e3a-9763ba2d5eb6", "comment": "Malware payload (AgentTesla)", "value": "0b5a0c9dfa4238830a22a37ea246fccfe636470a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404179, "uuid": "ca45fa7c-3b2c-410f-9de5-9444f2576c6b", "comment": "Malware payload (AgentTesla)", "value": "163f01afce969b42b50f13b80895fd096c91ba6e03b0395413f23671bdd5095abf1cfedd844b35f82c196b594e2e767e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404179, "uuid": "1f05ff17-862a-48fe-addd-c3ca00243860", "value": "T16BC43321EBCD0B428C8F6596DDCFFD0A4369AC05938471E23604FD95BEC392C57DA9A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404179, "uuid": "f6a6abc7-7e7f-4d46-bf2f-33a4d6b1d423", "value": "12288:X+DGjq7IZ0+JY3U1qcOpDcys9ZSbWe5i82K//UUB9siJgivxwryyMVEe/:uDT8S+JY3U1Js0ECe5i8h/V9H1ve+yMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691404179, "uuid": "9899800f-59fa-4766-822e-c66ed5b9a7d7", "value": 597113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691404179, "uuid": "f7c17a7a-88cf-4e56-a110-34f7f28c693a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404179, "uuid": "09b4e8b0-6e03-46ed-9e70-4d47376ea326", "value": "SOA Toshiba.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da693fe5-356a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691444354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444354, "uuid": "5d1bd56a-a13d-4e1f-96ed-8ac75ad4b8b8", "comment": "Malware payload (AgentTesla)", "value": "6f5c129ffeb71836ecd5f9358b75a80a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444354, "uuid": "494bf4ec-4377-4ef6-b60a-47a40813948e", "comment": "Malware payload (AgentTesla)", "value": "a12c2518ba4e1f0d526435d5f7b90ddff10f9796414ee0af0e6e0185e3183649", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444354, "uuid": "c13b8d45-ba30-45bf-b7be-0ed8744a46a2", "comment": "Malware payload (AgentTesla)", "value": "740c4287836a039e9a754f57caad50ce28f49b83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444354, "uuid": "d2d78968-aa55-47df-8df3-665cae41a0b1", "comment": "Malware payload (AgentTesla)", "value": "67fa482af6545fabe7b371e3ac91ee0b787f2e372d56e848e3e754d8cdec8ec9b2f012bd1921af9545d844252370b62e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444354, "uuid": "4527b961-5f38-41d0-86f6-7af402d8e92e", "value": "T1C1B423EBDF2655BC8F907368FC4CFAB952619687303EB5C6E2DC2F44798499A50E8007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444354, "uuid": "65292eca-4770-463e-85d0-6fc75a030b86", "value": "12288:TtQlwqiwWvMlDd6pksa1EXXvKayUSIgZmPCkjkzPQivDiD+apS:TCJidvMlh4PkH8CcQPJ8+KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691444354, "uuid": "91b48d19-d940-4889-82fd-5ad597d06066", "value": 528642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691444354, "uuid": "b21fd00a-dd17-466c-86df-73aa313cf717", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444354, "uuid": "e569807a-37e5-4aee-a729-51d5e259da23", "value": "nRFQ 080323%28MEC.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6903e020-3539-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691423118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423118, "uuid": "b3fc296a-0280-4916-be48-bb866f31a611", "comment": "Malware payload", "value": "7b8e85d5a4360ef0d29d399fdfd567d2", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenGrabber", "colour": "#7BB00D", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423118, "uuid": "8083c423-73bd-4a4f-a537-d9efb880ffa7", "comment": "Malware payload", "value": "a19d0c9e6e5de3ef7f74bdfc5bc81170326bad2372b79ce085ad8c085ae0d7b8", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenGrabber", "colour": "#7BB00D", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423118, "uuid": "5f77ad72-b0b5-4a33-b727-9ea9ee25ce90", "comment": "Malware payload", "value": "d7dc77017fcc69e4b0c7ec9cc94b6cb2305d4db5", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenGrabber", "colour": "#7BB00D", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423118, "uuid": "eb8fbb70-a99c-4dbf-883f-d13df100d8fd", "comment": "Malware payload", "value": "43f528fda15f08be829ed0b03bd139996af0f8a0fb06c8798616b286dbed5ead49620bc492cb6683482958912ae35f73", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenGrabber", "colour": "#7BB00D", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423118, "uuid": "6bcfe7c1-a728-4e2c-8286-92df61917476", "value": "T1C54185F1F317C0D54432A277ECA7D085AE78806E0021550A7AECC8DAE7B1D606276F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423118, "uuid": "073743b9-d2e1-4891-9383-258a9a4d9097", "value": "48:8ca+QnRpr1Vje11Z9IYb19Z/cPFFpgfqpg4:87+grLGZB191C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691423118, "uuid": "7326307a-8de5-448b-9d85-4ba5760b62fd", "value": 1955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691423118, "uuid": "75c02ace-9044-4b40-a41f-437424923699", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423118, "uuid": "1189311a-65d2-4cf6-9c3a-558224520847", "value": "2Yz94wEb.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304baad3-3504-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691400260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400260, "uuid": "e11f9148-0810-4a7b-8601-a89ae847fd3f", "comment": "Malware payload (AveMariaRAT)", "value": "7a8557e687e3e28e77bc1581bca06646", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400260, "uuid": "a8fd2bcc-a994-4489-9d39-a5fae1397cfe", "comment": "Malware payload (AveMariaRAT)", "value": "a2f7cf35b7f3e3681d884bebf68728e794aa79637c77c84154b78f7661c55c64", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400260, "uuid": "4aa052b6-f51c-40a8-bffb-04eacc796a00", "comment": "Malware payload (AveMariaRAT)", "value": "014c80036099ce580d6efc953d789f7c120e3b62", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400260, "uuid": "308575c7-724d-4684-abf1-46bfc9e05f60", "comment": "Malware payload (AveMariaRAT)", "value": "37d4ba10062cef8243b66bd3dce83cf01be950f937a63a12830070eb3cf5524663d8b00a422c98c7ba3fb707b518ad5a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400260, "uuid": "4c50ab5b-c616-4bc8-b0e3-8304e7727619", "value": "T12E84DE1E9ED601B4C1A4C870B7FA51EE1ABAA32F6512ABE7648813F5DF0574F60131F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400260, "uuid": "766c137c-574a-42f8-a3bf-be4442803b33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400260, "uuid": "b9197695-a35f-477f-9133-0da8e4866047", "value": "6144:Xme7WPpL6mbNWo3lYMFM9e+3YM54fVRt:X1WPpL6+WoiMFM13Yf9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400260, "uuid": "1fc06bca-2372-405a-bb38-8b07cd2a4ea8", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400260, "uuid": "cd6dbeb2-2696-4691-a7a4-2383b9d24853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400260, "uuid": "f38f49c2-1322-440d-9e73-14b213080d26", "value": "PO No_033672023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07398544-3505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691400620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400620, "uuid": "470d107b-8335-471d-aa2a-b98d28a48511", "comment": "Malware payload (DarkCloud)", "value": "bc34e97fff6fc9e9d5592d440335e62c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400620, "uuid": "644b7dea-01c2-40f6-b453-ecddd247731a", "comment": "Malware payload (DarkCloud)", "value": "a3792ec3b4a6667103902eb40b94da9710f8064adbd18e2e7a6da2cd3e27cf37", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400620, "uuid": "d7987605-94c1-4ad7-8de9-b925a4935e3e", "comment": "Malware payload (DarkCloud)", "value": "e7a959eaec43e232c69d7e68c80b4beaaa97b622", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691400620, "uuid": "432860b4-0447-4ea7-8845-cc15184c6861", "comment": "Malware payload (DarkCloud)", "value": "56fe9b04e3c181728bd058235a170cba7f588012910e720dc51ead12e6279bc586ce005fdb628e5bfb308f8da3ed8aef", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400620, "uuid": "6e181123-8f4e-49d1-a901-c9156c04f8c0", "value": "T137844A12EA69703AF073C4F1AAB4922778156E362244E89BF3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400620, "uuid": "52144d45-a7f5-476f-bbc0-9263bada7ce3", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400620, "uuid": "25da13a7-9530-4c80-932d-977901688233", "value": "6144:3hys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:3hys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691400620, "uuid": "fdd14888-d9d8-4f59-a016-74221a3ff562", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691400620, "uuid": "867a9348-00a1-48ba-83c2-91f138e3d975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691400620, "uuid": "c4888f95-f1cd-40e1-81e4-3259664d380f", "value": "a3792ec3b4a6667103902eb40b94da9710f8064adbd18e2e7a6da2cd3e27cf37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f58b39-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691372466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372466, "uuid": "11c8b068-1fa3-406a-b535-d382317fd77a", "comment": "Malware payload (Mirai)", "value": "a99ece37a96f9c4964269e514684505f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372466, "uuid": "87cf5e9c-48eb-4f54-a5dd-a5f6bd3eff1c", "comment": "Malware payload (Mirai)", "value": "a431f70f0b9ca28b4490e950958812d4be0467f55266b0e4de33d690e7cb44a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372466, "uuid": "938a8981-c63d-41f7-8ba0-3a8e185bb019", "comment": "Malware payload (Mirai)", "value": "3ade475a88e483be77005996e5b7d2f8f7a657d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372466, "uuid": "0faeb96f-77f9-4bb2-800c-da4a0de34450", "comment": "Malware payload (Mirai)", "value": "462cf6e0848cd44c41525c8923b52af487d3d6c599ef91f8a8e9af7c58a9bcf54f831f83ef1ea1a22e48cd126868612e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372466, "uuid": "6b060bc3-0875-4ed6-8973-4994966b4db3", "value": "T185C2E144F145DE45DFEB29F03D54CADBBBE02F1EA9228E8022A053C25F4C2664305ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372466, "uuid": "8e8ed761-f1d9-4a59-ac50-5d4cb268716f", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7P/z4uVcqgw09R:tam+AnKehPRa9az4u+qgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372466, "uuid": "35b10275-d099-4051-b14a-ba0e7fcc7b24", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372466, "uuid": "5fd3c2f8-ba83-4e25-802d-014a83adc530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372466, "uuid": "b66c4c83-a729-4a64-8069-61f4f2a3714a", "value": "a99ece37a96f9c4964269e514684505f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33d94f8-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691414680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414680, "uuid": "b9f9e1a9-be4a-4cb5-893b-fda2f1f70b70", "comment": "Malware payload (AgentTesla)", "value": "4d84d92e92c4c5de50adcd23f2135bd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414680, "uuid": "73d4fb6c-cdaf-49e2-b68c-e78cc58fddff", "comment": "Malware payload (AgentTesla)", "value": "a59cb21201fa989ccc0c958f5dda1cf74688c17c6833a24ee160643d48f4345b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414680, "uuid": "6075b8bd-6c23-4844-a02a-336f13980393", "comment": "Malware payload (AgentTesla)", "value": "c390023770ca22cd8ea5329ccef54eaa08637636", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414680, "uuid": "f810ba21-2455-42b9-b8fa-45cad1713c78", "comment": "Malware payload (AgentTesla)", "value": "a8378c79fab743a4802bcc2d69c1405db3ce0ed60fc204fe8491e6c8733717aa7c30635e28d949a40f3d721b221569e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414680, "uuid": "616a0063-bcb4-42d4-a528-bd622dc1597a", "value": "T1CD14AAE0317D93CFD1A28DB10FC98AB079F135AC98C4160DA0F69B2E93D6395549C9FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414680, "uuid": "1dcd5b38-0f9a-4cb5-8ad6-0a8f7eac476d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414680, "uuid": "530f75fc-2ea4-457a-8740-4557cfa32f78", "value": "1536:AU3SLT8tOeXv2tOAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgN:AU0T8YeXv2k+9wqY+mhhhmitqOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414680, "uuid": "56165661-92af-497a-913d-71d9b977ccac", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414680, "uuid": "972b8abc-bb73-458f-9ea5-61d2ca00e5ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414680, "uuid": "d5954fcc-5b58-43f2-a300-182f9ac323cf", "value": "Dhl Recept-673gtrvs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd54cc37-3541-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691426749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426749, "uuid": "440c153f-0e90-472d-83e7-9ded9faf00a5", "comment": "Malware payload", "value": "79c80f6c916250dfad7f433e1ff950ee", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426749, "uuid": "8b7975e3-f203-4fed-9a7c-48c3e1f4275b", "comment": "Malware payload", "value": "a736c699fe879975bc8daa8525984ba514ae96a294f74d570dff0cbfd2117e24", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426749, "uuid": "3ed10326-558d-49c7-978b-e634ca7fe74b", "comment": "Malware payload", "value": "e281b0719592b08b28184decdc1ea5ba9b33e46b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426749, "uuid": "103af5d7-c500-4a8f-b012-34db9c5d5336", "comment": "Malware payload", "value": "474796e85d9aa9c1fbbd51a8819b4b489f7b655c587d1a6256fac7f4f0589339695b1610c2c6c3e6e3ccfcd3c35a27ce", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426749, "uuid": "8531922b-4d7c-4abd-880b-176cc5771bae", "value": "T1425623BD2188331CC40AC4348933BD89B1F7511E5BEAD6BEF1EBAAD0775A825D905F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426749, "uuid": "1bd1dcf9-8e1e-4236-9b8b-00a234b58b72", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426749, "uuid": "90e3c40d-59ec-4721-a689-e9b840809026", "value": "98304:jLuSoV+yTXcmw9ghSxaq+zRliwT6MAUzk2wQuvvsn+AwUbbXw:+BrBphSxa7zXRTkUzkYuG+AwUPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691426749, "uuid": "27ade0ff-22af-43e1-b92d-d481f39d1896", "value": 6145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691426749, "uuid": "1dc0ef00-a16f-4a33-9ebc-8c47fb952711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426749, "uuid": "016fbffe-faae-4571-9513-dddf421b1620", "value": "79c80f6c916250dfad7f433e1ff950ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8572428b-351d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691411140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411140, "uuid": "f12d57d9-0f36-4af1-824a-a69fee0ddc34", "comment": "Malware payload", "value": "a8c6b9a92d1ba2271eaa8e2db016a1e1", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411140, "uuid": "ee47ccab-8d2f-4eb8-9589-5905c14b43c3", "comment": "Malware payload", "value": "a94f10add077c47e6608b05c9e36964c3bfea59a9bfa66e34d70ff3b910cdd7c", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411140, "uuid": "42d01227-7c5c-4ce8-b5e2-89b796230f26", "comment": "Malware payload", "value": "3a8ae8a765443f87dd71f51c0fa99c9f22c9837a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411140, "uuid": "55618034-5e60-401c-b167-72a915e099b0", "comment": "Malware payload", "value": "3441d4be0e9f768d2d5c95ca8d14f5fe75adbfcc247c735787f8ed9f746da33425fbc963638a6c8aa01b4bedd85bddf3", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411140, "uuid": "00c6e9c3-3665-402c-ad1c-fc764ea1a18d", "value": "T1E431713662F9030CC6715A3B68B1BA13973AB80DD91B4F8D32515E74181859CE925F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411140, "uuid": "b0e7ca10-c568-4728-a664-bf0a28a8e785", "value": "24:8NLZsxqtvPsETMFN7oK3aghW86IA+WSnZY+/CWmy3xeHEkl7pEQeyTppTpZab/2j:83t8ejpvInRBK7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691411140, "uuid": "18bdb499-f5ce-497a-800f-2fe73ee7b996", "value": 1569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691411140, "uuid": "78dd9d99-36a5-4851-8e16-a71384196594", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411140, "uuid": "c2a24abe-42c5-4ab4-94ac-21d9ec91b494", "value": "stable-ln.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bca0a7-3508-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691401988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401988, "uuid": "5d6c4b1e-1a28-4714-8b7c-f45ce4824e75", "comment": "Malware payload (AgentTesla)", "value": "659132a0b713e560856beb9680e620ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401988, "uuid": "a06ddd94-1f8b-4cc6-b29d-87bd32f09425", "comment": "Malware payload (AgentTesla)", "value": "aa08c315ab608d10cea917ce37ddac927dcb6aa0420e68d67ea76be3b6b8193c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401988, "uuid": "09ee9bcd-f83c-4c55-aed9-0d6c10031c17", "comment": "Malware payload (AgentTesla)", "value": "241262f1ce18ae1475df5396fdaafb3e287fa0ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401988, "uuid": "b55bd1f8-6243-45f2-8536-9f06b1b4c6f5", "comment": "Malware payload (AgentTesla)", "value": "2b90e845480326bb50644f488c17545b78685a52376f3b870ac6fd9f684aaca2dd543ef439419c63990e2974a526fe87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401988, "uuid": "53b44d37-3491-443e-805a-b67bff92abbe", "value": "T175C4DD5931CC80A9E2753B0587EC11FEAF9BF1C657B8893A0444651B77DEE884E903BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401988, "uuid": "4b3df447-4614-4283-8d6f-d6af3ec3d7de", "value": "1536:23LRV0ubIGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWGPrbrbTDDpDFb8:cVJ5WkvBZ9Ya//wiej6lwvaOvQBSPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691401988, "uuid": "18158883-a41b-43cb-8fbc-7cb2c0ec1b99", "value": 582440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691401988, "uuid": "7d51ab32-ccc4-49a5-bd34-aa2cb00f4452", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401988, "uuid": "dc025bcb-245e-471b-b07a-8b341f70f39b", "value": "nigazxbb.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb37407-34fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691396494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396494, "uuid": "feed8f82-dba1-46d2-add8-dca2553aedca", "comment": "Malware payload", "value": "02a41827dc3955305c1ab951a79405f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396494, "uuid": "56b2e896-37aa-438e-b12c-843e6af4c11a", "comment": "Malware payload", "value": "aa248d230808d4ec3ecaca3f4a05b405dfad6a34481903dc31c7d7ff6f137115", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396494, "uuid": "004903f5-72b8-45e0-8acc-b1c76cd5cc31", "comment": "Malware payload", "value": "c01a772596f176647a5ad54c86994fc3de1fb20d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396494, "uuid": "f28cd009-9c5b-4a59-9572-5ac0d308a4cb", "comment": "Malware payload", "value": "876f9597de30d036f31b59aec8e33a87841da2355acf60d297362a4295b3a47c8258a795b2b0c2375ae871324b05c9f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396494, "uuid": "9aa3856b-c7e8-473d-8756-25b780b4dd3e", "value": "T116B60783F811B2E4C09BA1758E2156E17A31788A2F35B3E71B90A76A0F357F49F75720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396494, "uuid": "55aac811-a42c-4fd1-bb6d-500dac2b9903", "value": "49152:zlof8HDu/gWu9Vsrb/TrvO90dL3BmAFd4A64nsfJY9tdozqgGqalNtr3Afp1zRnj:zjHIwHIvqyeSIYE7+Ww6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691396494, "uuid": "94ee1866-f7e6-4f9b-99b8-a38cf3845586", "value": 11076832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691396494, "uuid": "c67da31d-c1a9-47b8-959c-436317004e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396494, "uuid": "9105d0de-6555-422e-b9ae-f971faa203fc", "value": "2023-08-06_02a41827dc3955305c1ab951a79405f5_hive", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36789e4-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691414653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414653, "uuid": "1d470992-8516-4945-bd8c-a25db55346eb", "comment": "Malware payload (RemcosRAT)", "value": "c227c2d2a966c686fd33424d5d4c9487", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414653, "uuid": "caa7e72d-8e09-4637-b8d5-35e9408638c7", "comment": "Malware payload (RemcosRAT)", "value": "abd62b9dbecd1edcfea357746b8631bb30cfead55e75fdaa1999cc50063ce36c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414653, "uuid": "12f23f27-69f1-4439-bed3-e7401917c922", "comment": "Malware payload (RemcosRAT)", "value": "e2eb7f48c0be9605cd9aceb65c69ca5e5a2f3823", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414653, "uuid": "7f30b304-64c5-4cad-be92-0321b4256538", "comment": "Malware payload (RemcosRAT)", "value": "312ce7f956dcdd2d3ebabf1db42377966105c8c70aedcdc883d90b24ee0a1b6fd296e519a7a3afcf63d6b1d135278938", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414653, "uuid": "7c082012-c06c-45b5-9c1c-2fdfc81fa0af", "value": "T1B0724B746BC20B3F053E16B69846002DD4677DA6173214ABE84CBE684BF7304BA3B5CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414653, "uuid": "2f201ebf-6bd6-4f83-b7c3-093760b06e47", "value": "384:gMeruO/weDRxev4XaL9CluUeFFyFuEZc3kHq:gvrumW9C1qKDZc0Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414653, "uuid": "8d9d14d4-67b8-4ebe-9f55-d8855a14ca02", "value": 16585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414653, "uuid": "2d5dd9d9-ee27-4092-9db0-c87a53e6a33b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414653, "uuid": "e26693b5-8618-4802-85fd-27cb83e69648", "value": "doc_1000124808072023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2364d3e6-34fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691395943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395943, "uuid": "ba3703b2-3fe2-4b0c-86d4-0a33d04c649e", "comment": "Malware payload", "value": "8f5342770ce07561d59bfd66578c4c91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395943, "uuid": "4f3133cf-30f0-4eec-a3d8-5b20ee6fefe2", "comment": "Malware payload", "value": "ac0bff1a7525643d98bf2e590431681430639fc22c07d215baf4c14c51dff965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395943, "uuid": "812c7d4a-b7e9-4e7e-876b-8571b6633da6", "comment": "Malware payload", "value": "0234f40fdea8d12096d06881dbe07ad59fc8fe89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395943, "uuid": "b6135ab7-21ba-433c-95f0-c83f63477f66", "comment": "Malware payload", "value": "b9f0b3db09c54598b56f17cf4d68c8baba74ec6355e7c730f20bc5e9724d5e69d622a0aee7a8586ed1fca4b5c7fc687b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395943, "uuid": "690722b7-4366-41c8-8490-aae87b1db7a5", "value": "T12F84129273C74B00CD2524BD44EF823A07E16FC369378AD9BF0C36A95E16A139F96946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395943, "uuid": "c6407ab9-08f2-4921-8307-b60454b4d054", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395943, "uuid": "9ea9b603-cda0-4639-ab9f-a2902a6fdf05", "value": "6144:qiyrlK2EmkseqwA1Lxl6dONR8NQLkNNL66hUMK/W3dDUyhU2rV:jyrlK0np1l/g+LkNJDhUp/WtIVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395943, "uuid": "74391b7e-a863-4da8-96b2-9ea25216e764", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395943, "uuid": "60a5386a-b5be-4bcb-b134-44e437363a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395943, "uuid": "5e58c0fc-ab94-45c7-a1a7-5fb12c440f28", "value": "ac0bff1a7525643d98bf2e590431681430639fc22c07d215baf4c14c51dff965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4672a41f-34df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691384405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384405, "uuid": "12e7354a-5731-4944-ab74-9ab1186485a3", "comment": "Malware payload (Mirai)", "value": "c0abd9255a8a2e036e5a7d85dd594eaf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384405, "uuid": "066608f5-fe89-44d5-a3aa-349680105db8", "comment": "Malware payload (Mirai)", "value": "aca0f0c0319b85041e4ec0a9697d4d9c4836b6850d637741ca73bc88eb1cc8b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384405, "uuid": "c94f4bcc-e641-4a3d-91e0-e9504bfbad94", "comment": "Malware payload (Mirai)", "value": "c2f27d1ea4073e9de76de86ec93e9ce94b8bd0c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384405, "uuid": "600e9872-6ccd-414f-ae52-a4a06f9886cb", "comment": "Malware payload (Mirai)", "value": "c967bd1fe13886dd1a5c30d0c6a7dbcca1e83a4f013b8d70f009c9fc00d205c7fb0d886659ded311b0ebf275b7b849cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384405, "uuid": "921dc8c4-a731-4eb3-93bf-716df7e904a4", "value": "T134735BC8BA83D4F1FC6309B25137A7728773E12A546AEE42C729AD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384405, "uuid": "4cdf80d1-e93a-4864-99c1-ae313a78a107", "value": "1536:ui0zORnGPoKB5KAnkUhlpdtqNEloSjot0rkCeya:f0zEnQoKHSUHLt6k1js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691384405, "uuid": "234a4f10-efe0-4ac7-b5e3-0422d0969a8f", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691384405, "uuid": "ea599c10-dc86-4ba5-ae9d-9dd77d6d2e47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384405, "uuid": "52a7fa25-ed7d-4305-8bdd-578fa0e3acf5", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438c0fe3-351c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691410600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410600, "uuid": "a9381110-2587-4b82-8f3c-dba5a27cf18a", "comment": "Malware payload (njrat)", "value": "362ef4226a7e1b580c88b88f93076047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410600, "uuid": "290cc6d5-f580-4843-afa0-758b30f72f1b", "comment": "Malware payload (njrat)", "value": "ad352edb783a12602f8109b28a95c44adae565a2404eb233fb6cb78a62b0dfa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410600, "uuid": "e90473e7-eb9d-40ce-9585-68890bc3e56c", "comment": "Malware payload (njrat)", "value": "47e7288c554658ca2c4eb7caa5d381bd5bc02ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410600, "uuid": "75599cd4-9603-4b0f-a45f-13706edce442", "comment": "Malware payload (njrat)", "value": "3f19214c76b008addfef48215d486ef810be66aded2a55cdc5f598164d4cd55c72631e203ef67f2348edb6806ad27035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410600, "uuid": "96793c59-40c2-4028-8103-709c118bd91a", "value": "T1BF32096092D841B1DA315A377C1A6B056FBA96BF6D1B5A6E30CC081F3FB3111C7637A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410600, "uuid": "32fb9e3b-8a7e-4f7c-941c-e645ea23c089", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410600, "uuid": "6b9e15af-47e8-4214-aa3b-641fe8c670f7", "value": "192:Fe5eA/s215YWFhnA78feB8vkYcV6qU2FJFEs2+:U5eGTYWFFAIfeB6kYcV6qUiJFnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691410600, "uuid": "e3c23690-b802-4984-924b-39d249401bf4", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691410600, "uuid": "c3446d14-5a24-4593-8b86-069d616e4199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410600, "uuid": "326f6650-61e1-4214-918f-49eb13122170", "value": "ad352edb783a12602f8109b28a95c44adae565a2404eb233fb6cb78a62b0dfa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50870fc7-352d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691417923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417923, "uuid": "078ed5a9-944f-4429-894a-546a562437cf", "comment": "Malware payload (RedLineStealer)", "value": "8a599ff1cee0f25d36332cc64f722673", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417923, "uuid": "e3b645c9-fd65-4123-ad7d-9b59868e9447", "comment": "Malware payload (RedLineStealer)", "value": "ad6672b5390661b265f162f695ce7e75d0f8a11bbc9847d04893155219c9c2b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417923, "uuid": "c12ce49a-d6ef-4589-95f3-dd13321df7af", "comment": "Malware payload (RedLineStealer)", "value": "242f2816c83cf26d49abc40079ba3458b1d58b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417923, "uuid": "c4dd5525-21f1-41ba-9cc5-dfbcd44f8ba4", "comment": "Malware payload (RedLineStealer)", "value": "0dc148b1faf7e0ee213db359f296307c80e0bdeee808ddf455dc65b4fbee10dd15eaf3f361adec79d1335b33ddff2b34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417923, "uuid": "ce9767e1-c6fa-4a16-a951-a7628171f6a2", "value": "T1F7B4123402685763C3AF87F3EB62B22543BD76624486D3CC6E59F0EF895E7406496393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417923, "uuid": "75d2bbc1-7b6f-4151-ac24-868d546e99d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417923, "uuid": "717dd665-b214-4e89-9db2-3059052fad85", "value": "12288:sW3RmeuWCLraizRk5KnNOKNAPhCmjN/WN9i7cBapTkxyKW:ZoeuWCXd1zNORQO5WN4iWkxrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691417923, "uuid": "cb2caa3a-6cd6-46e6-a506-563252379a3f", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691417923, "uuid": "be2f3058-e643-47a4-a592-fe55ec400676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417923, "uuid": "e4137fe7-efb3-4924-a439-45471731b4de", "value": "8a599ff1cee0f25d36332cc64f722673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7472c6de-3510-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691405528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405528, "uuid": "148aaac5-6e66-4903-893d-3558eaf7a4af", "comment": "Malware payload (Formbook)", "value": "3db137b68ac902eaefc048a4d04c89c0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405528, "uuid": "dc4a1f3b-7b8a-4e79-921a-ec5ee7816b52", "comment": "Malware payload (Formbook)", "value": "ae8912485487bbd99f7defde38ab0da19ed679c5eec9d0272ec8ea69fc7d191d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405528, "uuid": "db1aa850-83b7-4570-8ae1-82baadaa8074", "comment": "Malware payload (Formbook)", "value": "c2127b40577e2a59ea0d0dea98f4fa96a77fdd8a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405528, "uuid": "481f7bb7-249e-46a9-a742-00269f4aa1e0", "comment": "Malware payload (Formbook)", "value": "11eb627532f0b12f82f4c4bd3536a09eeb71d2de422134a0cc61e9228d6c81a9fc04bfa6e20d125870617310962fd46b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405528, "uuid": "42a4152e-c8f0-4810-b588-7151461af068", "value": "T1DE43362DC34F02A9CF565237AA1A1E4442FDBB3EF65512A1305C437933EE83D62652BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405528, "uuid": "02791214-0fa1-42b6-a842-988ead2d81d4", "value": "768:pwAbZSibMX9gRWjIxJDZDFpc9w13oCGj9DeJM4ujBJPlfZS:pwAlRzxNZJpc9wVoCGj9Kmlf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405528, "uuid": "aa38e493-1eab-490f-9c59-6de734ac2e3a", "value": 57025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405528, "uuid": "4b0c8c2f-7a0f-4090-a606-d1e2ca7bc2aa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405528, "uuid": "d9274c6a-1cad-41a7-b016-c4f6ceb734c3", "value": "4086EA3B.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00575890-3517-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691408340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408340, "uuid": "21847459-afe5-4d06-9388-2c4fd2c0b3ea", "comment": "Malware payload", "value": "670cdc551e0988e950278672112e9b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408340, "uuid": "38b00f88-9837-4a12-b440-c8ec10d90022", "comment": "Malware payload", "value": "b3db628047c81b8167418cc6bc25c7f033cee24ed248b885795b36cb82b1ed6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408340, "uuid": "65b05aaf-987f-41e6-8835-555a3ac89ced", "comment": "Malware payload", "value": "52cefc6b4b6654c4b13003ea8e71ae7ba936411b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408340, "uuid": "021ae604-56a2-4e00-b4e9-a100853113c9", "comment": "Malware payload", "value": "4cac05585e20b6a502dc5fad6fdde0a5e82e90a8cfab4c995a61c0ddc848de85f71236bca7a6db470d5a55be5a09ce52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408340, "uuid": "1d54ffe2-7313-4582-b90c-ed4f56ddaf82", "value": "T1BB95236467E509F5FDB6823EC882D857D6B0B8111324DF8F43B4822A1F276612D7FB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408340, "uuid": "e6c5aa3f-aa20-47c1-9ccd-cc696fdac6f0", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408340, "uuid": "7c2fc96d-b809-4c88-bcc9-91606bd7f99e", "value": "49152:NfGwrEr5dFBMxk9m+Wbg5Hl3PwBvSe4qjCmgfyK:oCEtdFBmamaHl3Ne4i3gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691408340, "uuid": "5a09ee7b-ecd9-4c94-b909-191a32173224", "value": 1996800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691408340, "uuid": "3619b2fd-38e2-4791-9536-ddae2c7f51c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408340, "uuid": "4bd9eabc-65bc-4191-92ee-410d8b99f0f5", "value": "vt_0d77a2946d6fef80cfd5fcd0b69d33a4dfae85d27c4e8d2476632875abd0f8ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e8b56c-3518-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691408861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408861, "uuid": "0e511a74-f695-42e5-9396-bbebc5efabc9", "comment": "Malware payload", "value": "93aca7ea25982f2b0849c098170392c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408861, "uuid": "4dedbc0a-3bb7-475a-95dd-08401cc2beb2", "comment": "Malware payload", "value": "b4c9706253411df605460f4e2a6988dd4455ef8c0980a3673dc719219d3fb505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408861, "uuid": "5209d467-bf69-45e2-aee2-b1733825c4a8", "comment": "Malware payload", "value": "6c9cba5cb17f414506011544ee510b322a7d6f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691408861, "uuid": "6d8757f0-6a7e-41a4-ba00-8cf00ef1f0d7", "comment": "Malware payload", "value": "dc769d28fd3086056e8e670e252c378d1a893a7e1825e940f63c833f6a34a388d91341a3aa29022af6f6a860e9ba171b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408861, "uuid": "b6eec64a-82fd-4bbd-8f70-f7d7cd47105a", "value": "T1BFC46A983614B2FFC4D7D53AEA580D62A75074F6930F0643A0A719EC9E4E59BCF208F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408861, "uuid": "ec660594-8179-4811-9352-6ede8afd7c42", "value": "12288:WJRzF99JPN+x88PAsHDeH+EYXN9iYsolyHzDmor4Y:EP9v+N1HyHkXNZo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691408861, "uuid": "3a74f816-f17e-492a-a651-8e5898789eea", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691408861, "uuid": "08bf106c-f727-4909-9837-9a3e16dd499d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691408861, "uuid": "f314598d-c431-495f-a4ad-fe2d82c300e7", "value": "b4c9706253411df605460f4e2a6988dd4455ef8c0980a3673dc719219d3fb505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb30a33-3513-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691407022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407022, "uuid": "18eac016-7cd4-4a09-9eb4-955f5476ae38", "comment": "Malware payload (AgentTesla)", "value": "0c92907c32cb05bfe560770af59dc77a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407022, "uuid": "e7520a2a-b75a-49c0-8c82-e345a0394958", "comment": "Malware payload (AgentTesla)", "value": "b54bb2f83ecfbd30dc44b780e6bd4f870748ddfaeb598a4a65dc505f87bd60f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407022, "uuid": "68dda96a-c958-48ae-b70a-3f6580705a5d", "comment": "Malware payload (AgentTesla)", "value": "cf5bc87fd842602d3069fd72e5103ee1182e39a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691407022, "uuid": "cbee0251-c6c3-4c27-bf7d-ed34cf73dd0d", "comment": "Malware payload (AgentTesla)", "value": "4246da1b5c93e8a558d3842d71a5c9f1b5124e72ec99a7a12df5d1389c2509ac83f92eaa90b56d6994100ae410456a9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691407022, "uuid": "8cf361ff-37d1-48ba-993f-6690bc88a8ed", "value": "T15D3482145705A831D7FE43B7401587A4BAA3FBB13A0FA1362A75AFC42F2119CF93B985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691407022, "uuid": "5badf55c-4ba3-4510-8e55-4d1180a44eb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691407022, "uuid": "e932a816-4482-439b-8130-821c83ae155e", "value": "3072:+7yRzAgENiQjYVZMpli/qqNbwmIFmImuJG13fOf9GWirA0gbYK:+OLNbUFlJG13y954A1bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691407022, "uuid": "008089c6-37c5-4c19-9ae1-946b039e79e9", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691407022, "uuid": "44466b16-a4af-4479-9c20-e508a1ed7aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691407022, "uuid": "42e10026-c517-4929-ab6f-4b4f73c8206b", "value": "b54bb2f83ecfbd30dc44b780e6bd4f870748ddfaeb598a4a65dc505f87bd60f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bb5200-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414764, "uuid": "de18cead-3fac-4904-9377-9d55da504a8a", "comment": "Malware payload", "value": "f4250f8e233aad51bf090a5abd2ef1e9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414764, "uuid": "e606a81c-ecf6-4411-95ff-286eb03afbb5", "comment": "Malware payload", "value": "b5e5ec1d515494c3fd53e720bb1a9c1ddd6bce947f829db79913946b23a85347", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414764, "uuid": "bb62c9d4-b612-4e18-8cd8-fce27c6c7139", "comment": "Malware payload", "value": "bb94da805a9d2ce8b5c6c0778a0272b9304b4066", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414764, "uuid": "83b7ccc8-b829-4342-b901-f26acaa49a2e", "comment": "Malware payload", "value": "a0a1ec3d9a55f045f069b6d1735ba590fbf7c2affc28a1e26fffb1f6f3196938b07c465674e723cbbdc05401f46c20ec", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414764, "uuid": "d6792799-1a76-4e2c-94b5-7bae120992ba", "value": "T122838DECD34248E18F8DABB747161D8C022D307FFB8614A87455BBB139F7A6259188BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414764, "uuid": "cb99c9b9-559d-4138-a832-80beb25874cd", "value": "1536:RO1ZG+XjQFt6ActCExkVKMileUSfur9uco65qTNBVslA+3lbzBqtoX0Q+gChFDnV:RO10MltEh9dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414764, "uuid": "0b7e28e8-ce51-4c27-9aab-988772d46840", "value": 87006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414764, "uuid": "fcf375f1-f8a9-4b7b-9399-6918c7145cb7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414764, "uuid": "a4e7dbd4-4892-4216-abdf-ac6e77ee2880", "value": "LAGOSTENA S.R.L. Purchase New Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e43566-350b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1691403598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403598, "uuid": "e73ca400-2f7b-464b-99aa-ddaff3585952", "comment": "Malware payload (RiseProStealer)", "value": "d19a1cbaa86d7d720fc252a0cd8cac8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403598, "uuid": "edc62206-4d7d-44e5-b9fb-c08e272e65f4", "comment": "Malware payload (RiseProStealer)", "value": "b61877825d8cff4454bab969656df67196bdf02d86704ab3821845d57023bc5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403598, "uuid": "2bd09fba-9502-47ac-becd-71f226e9067f", "comment": "Malware payload (RiseProStealer)", "value": "9139a0d623320eb57c5df1c5326693370b8177d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403598, "uuid": "65fa6d87-d5d0-4e10-83c3-fdd2eaa2f6a4", "comment": "Malware payload (RiseProStealer)", "value": "5d4ee9de57d2838385c83a6abc8b2a108dc3518bae2e7b2df512370c48be74d2bfd987d56d091c4ed68acbaebd1cdc2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691403598, "uuid": "a7d2fae8-c4f4-46c8-b94b-f0dfeef1ef7d", "value": "T1FC56236352651485D1E9CD3DC633FEE873F707278B42F8B465AAA5C620129E3E312DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691403598, "uuid": "fd2b3174-46e1-4cad-9572-65784a33d67e", "value": "5655e27fdbf7c1df56e25a218a416f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691403598, "uuid": "d79ab6bd-5eca-40d8-934f-4da02ef26264", "value": "98304:ifNDMZm0cQ+RBoFHObsf09HTaCjxy7cILMDPLXJoCPUe9pZvh37nkTU0zr:imo0++msMBaCjU7cVfXSCPZ9pxZnSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691403598, "uuid": "0e390133-5cb3-49d2-8a7f-577251cc7542", "value": 6397952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691403598, "uuid": "79b8e097-87c4-438e-82be-5f327a891f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691403598, "uuid": "3f62f5c3-d49c-4a78-89fc-1e37e8d6b17e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b47997-34bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1691369431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691369431, "uuid": "305b1b33-e2f7-4b85-a63d-3e33ade68a39", "comment": "Malware payload (Stealc)", "value": "26ace7baff5336943808674ae4fd06c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691369431, "uuid": "80f9580e-e751-459f-902f-6dbade3a5480", "comment": "Malware payload (Stealc)", "value": "b63d41c60aa52cae9806a4fe233d9a55b0c2dfdc67f215ab66c660503cc1a5f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691369431, "uuid": "ae501cec-f36e-4497-808d-0b1afdb64fc6", "comment": "Malware payload (Stealc)", "value": "92e29c2f709aab4d6710d7e2c7d1131b557433c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691369431, "uuid": "e9e986a8-b4b9-47c9-95b9-5c44a58dfac0", "comment": "Malware payload (Stealc)", "value": "0d1d0bf06916681d80071e2db6ba6c45b3852c1334dcc1c2dde087b9fa7974f753ec3b447f1fb10044a177734f30b2a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691369431, "uuid": "5a90dd2e-6b6b-4679-bd73-6c5bc402e1f8", "value": "T1EE161E6300F0B1D3A94456F99EC7B3A26E0A6C61D7103C57AA303AB46677971DFF290E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691369431, "uuid": "9dfc5bed-c15d-49bd-a13d-b0d7786207a6", "value": "e8ad8952dd52988517343d67208f519f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691369431, "uuid": "381004f2-9a3c-4db1-9531-01524aa0b180", "value": "49152:eDK81kgmG+2IiR7zHN635ZfVQkCtdtCQghlmE+VEKH2IM:st737N85ZdQkKdtRSlV7OxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691369431, "uuid": "12ecc5e4-2747-45e6-b87f-4d01adf17641", "value": 4147704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691369431, "uuid": "505e2e32-b39d-4c3d-a7e3-a768f471676c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691369431, "uuid": "907a1046-55f9-4ee3-afb6-2719fccab8d5", "value": "26ace7baff5336943808674ae4fd06c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58660ee6-353d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691424808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691424808, "uuid": "e5d746d8-6c7e-44ca-9326-0c2ad7574edb", "comment": "Malware payload", "value": "cd686e0a36f98a589a63b87fed7696a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691424808, "uuid": "634a75da-1d51-4e81-b1ba-21f1d6c3864c", "comment": "Malware payload", "value": "b6718f85526f371a9e7bef6d4728156be869428b16d788718d11e32c94c61884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691424808, "uuid": "c9d4e12e-f16e-4c9a-a791-5fd646cdb1c7", "comment": "Malware payload", "value": "a9fe498fdfeffcbf583d56d2af521df365eea534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691424808, "uuid": "82cfa021-ae25-4bd6-a5b4-3f636cc3a33f", "comment": "Malware payload", "value": "734205aafa138f592d0f694fe57b1c179e197ab963fc4eba0756f111a6481b77fba9643f6038321058cd96504a6f1137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691424808, "uuid": "e15c2bd8-a00a-4945-ba82-26be773e5ecf", "value": "T1F156D0620FA613DDE049823E48890D2E6E9DCBBAC6F8F154DE571256D9706243E3FCB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691424808, "uuid": "0c217a5c-67e2-414b-871c-8e91819c8ad4", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691424808, "uuid": "dcc12f52-5fbc-440e-998a-c27d715cd18e", "value": "98304:0leOg5Yaa3EMLRZ6pT0cmeG0TZK9HpqC9TdhraGPwT7TRERN:00SEfpQneGWcJ9pHRwnTRAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691424808, "uuid": "4f98a924-f43c-4582-b9b7-930917ba9da3", "value": 6027240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691424808, "uuid": "e5231af9-aef6-4b36-94f0-a02f6ec492d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691424808, "uuid": "c0a86b35-e4d5-4a05-ba14-5b6743ca6929", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaf3c50-34ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691398321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398321, "uuid": "d88f6ad2-fcf2-4ae5-8813-684fdd2a9611", "comment": "Malware payload", "value": "c7f1b99491f8efbaed29a43846dd9d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398321, "uuid": "66174994-f8f2-4e02-aef5-74fe33b61ee2", "comment": "Malware payload", "value": "b6db170a7c721324794f49cb6c00d11a352a63d5fd367a4d6b179ca68f022ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398321, "uuid": "68e42c5d-879e-4dc4-90b5-2cd44120b9a7", "comment": "Malware payload", "value": "a9623cba2c421700d3b2a8db77196baa5d913f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398321, "uuid": "0134059d-08de-43cc-85ef-2078a9dbdaed", "comment": "Malware payload", "value": "7c4e437108ee77f0a4cc2b91fbe89bfb78db2b4db374e2f41f5e0d4c5035094f3484d5a65eab95810b8ae0fa82bace9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398321, "uuid": "d7d0ffea-df9d-4f7a-83e8-3ae653fe4916", "value": "T123F4DF83F25990FFD4D72631016A7226EA20672E03358DD3738E46F6AB65CC2DE38749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398321, "uuid": "2a634569-9511-4fc4-b90c-53bf96452cc7", "value": "09bc4ce97fa66d19e612abe83e8c8011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398321, "uuid": "22798d23-4092-4dad-a367-09e50d36a0d5", "value": "12288:c1F4u50DIQ8AXNIYvPPpT9xoyPH1cxLHRa69ZiTtJJBV1Ls2LMpB8aN:c1z50DV9XNIYhT9xoaVc5H3ZgJJBV1LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691398321, "uuid": "1a04b648-401e-4b67-816b-f73e7d00091d", "value": 754711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691398321, "uuid": "534c749e-222a-44f3-be41-14b66807fd22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398321, "uuid": "9fcf3f12-6942-43f8-a61a-59e4e1c10db2", "value": "pay2-nemtom88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8800585f-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1691372490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372490, "uuid": "f6c979d1-5067-4928-898b-a6e178ef2470", "comment": "Malware payload (Stealc)", "value": "613ba44c4ff2fb8e3f74f7ad29d18244", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372490, "uuid": "115b4c98-eec3-49ab-977d-34fd142d7f85", "comment": "Malware payload (Stealc)", "value": "b71f9dbd9296b5c598a2f9c5bc45c73baa00dbe19520a5dbe812e8975d7c62f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372490, "uuid": "dcca2cbb-dae4-4c52-9c49-c7b1a5ef9ca0", "comment": "Malware payload (Stealc)", "value": "8df9e4cac614e8506e7bfea255bf1a4ac3d1c638", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372490, "uuid": "766dff46-9e81-42c2-a7dc-cf8394642056", "comment": "Malware payload (Stealc)", "value": "30e3f7dda4b238b369e903d25624664a6b64bcb8a79e33205875488483bab908207c7363d4b1bcb7a81f9e8b9223ae65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372490, "uuid": "975b3f48-f613-484c-acfd-e0a7eef8b19e", "value": "T15B067E20D6CA92D0CF692DB29E5BB4BA46046D60CC32CD4BEC1E7D513537834687EB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372490, "uuid": "72ca0383-3d21-4d62-9e17-f1eb2e7ca4a9", "value": "3293ddb1c3687762145ebb6ae84c84f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372490, "uuid": "1a523f87-5934-4654-9f2f-255ed5a97041", "value": "49152:YvnQHJMAYe3gWX6OpfHjyLQq0hnK18BS1ZTPF:gQpMbe3LXTpfHs10hKy4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372490, "uuid": "bdb0ead0-cd1f-472d-b3de-466d994ee64a", "value": 3942736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372490, "uuid": "6370b591-ac64-4deb-aea1-8af88309d154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372490, "uuid": "b428c429-b0f8-44de-83e5-bc80edadebd8", "value": "613ba44c4ff2fb8e3f74f7ad29d18244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde47631-34c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1691372204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372204, "uuid": "e93ae8e3-4e0f-43df-8a55-430a24cbcaa6", "comment": "Malware payload (Rhadamanthys)", "value": "c51b336b579c7d162f5c1c5ff4ce5599", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372204, "uuid": "63d2fb1c-27a7-43b1-bdd0-c67621c4cab9", "comment": "Malware payload (Rhadamanthys)", "value": "b87c03183b84e3c7ec319d7be7c38862f33d011ff160cb1385aea70046f5a67b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372204, "uuid": "e41d9daa-ad81-434c-9c2a-c30b0620c239", "comment": "Malware payload (Rhadamanthys)", "value": "4aecdeba060ce6db6c62558795b9dd7fd2887c74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372204, "uuid": "872882a5-4cd0-40f2-af67-ee5b093c1260", "comment": "Malware payload (Rhadamanthys)", "value": "52ce095809f03877e6b47f05e60049010472cdea80cbdbac7047f9e16f36acc99bb04e997dc7fd2c384dca63df98b7b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372204, "uuid": "023203da-1de4-4e41-9842-6de2526a47e1", "value": "T18CB4CF1366D06871F6734A338E2A86E8FA1FF950FF5577EB12589A2F09B01E1C672311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372204, "uuid": "ad47feaa-907c-4170-82de-5f8313a03195", "value": "497066eb74b90edfec949c6dfd6acab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372204, "uuid": "637ac6c5-f884-4a33-9102-01c9aefc1aa8", "value": "12288:1wp22xVHgBv7za/9j2H9PtbSse4YR3CXp4+:1wp22VHOze9uJBSsejhqC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372204, "uuid": "58d0ab2a-497e-4663-9445-422744461896", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372204, "uuid": "ed416470-b922-43be-9695-fb89679ae02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372204, "uuid": "edc70a5c-68c4-4ccb-aa6c-e29511299601", "value": "c51b336b579c7d162f5c1c5ff4ce5599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d723506-3534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691420844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420844, "uuid": "7d226226-0ee0-42b6-a4fc-0fe57901c804", "comment": "Malware payload (RedLineStealer)", "value": "438bd2df779c4293e2ccedae822e3280", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420844, "uuid": "da423e8d-6b92-4545-983e-d7ffa4e58427", "comment": "Malware payload (RedLineStealer)", "value": "b881e9f36f2447ca45dfdab5c9faa7601da86bbeeed6336e7f94f4e006997e77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420844, "uuid": "88268da5-00b1-40cf-b999-10ec16c71342", "comment": "Malware payload (RedLineStealer)", "value": "e9559a9d6ec285fce2b2bddbe5c2e397c4b25789", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420844, "uuid": "97a37011-f4cd-45dc-afd8-23c2374000a9", "comment": "Malware payload (RedLineStealer)", "value": "52ca04dac90c788d56738466604d2cb86dd056d2fa40b50d7bb3ac5ccdf6ac12b4afe6461ead57e85a904d357fe14f2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420844, "uuid": "9db4cb5b-b8f8-47f6-932f-68b8029827f6", "value": "T194C412179BD94572D9B627B02CF707830E357CA6D87483BE1381999B0CB26D8A47273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420844, "uuid": "4670e5a5-c841-4ab2-8227-78c64280e09d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420844, "uuid": "eec604ae-a308-4a16-a089-d85ca6dd8f3c", "value": "12288:DMrAy90+RJUB1WTE5iBACnWAeS/3dQtE4DCPRJYb8jSuAa:vybWt5iWCnFeSOnDURJbjSVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691420844, "uuid": "6a4bee83-0ef6-45cd-8171-f6bc796ede14", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691420844, "uuid": "1b3b9775-7f8a-4a06-81cf-a598fae232b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420844, "uuid": "2ce2d0a0-80e6-474b-bc01-99fd4c5a24ff", "value": "438bd2df779c4293e2ccedae822e3280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458c3c1d-34df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691384404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384404, "uuid": "284c46f6-06fa-40ba-8302-f26cebf38be7", "comment": "Malware payload (Mirai)", "value": "79298bdd05136cb07ce1175ae47f0d9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384404, "uuid": "c99ea71b-971a-4b7f-a488-f79c4363eeb3", "comment": "Malware payload (Mirai)", "value": "b8aef4885cdee2202aaafbfa392766407e77fd6204e6c93d48a5469a392eda31", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384404, "uuid": "a3dcfda1-6f1b-4b3b-a393-54658e6f1950", "comment": "Malware payload (Mirai)", "value": "9c7fc572ef73ed3331a456b20e605df9fe949918", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384404, "uuid": "dded799c-6f40-4877-860d-a3b266c6e594", "comment": "Malware payload (Mirai)", "value": "cd187ea0334a7af8366f377195fc7aacf09378bdbff7f969db0d1290a689e79a94cd5fcbdbc4999f2f60effd478d978c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384404, "uuid": "dace7a7b-667d-4173-ac2a-81be9922b939", "value": "T13DF31A46EB404B13C0962BB5FADF42513323AB5497EB7305A528BBF43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384404, "uuid": "c719a0b4-3084-45f3-993d-f26b7bb9fe2c", "value": "3072:kJquOt1Y7AkbaGkrpWRTdxEUHm8p6/szDDohM/Rypb9F:cOt+fbaGkrpqTrmW6/cshM/Ra9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691384404, "uuid": "f2a32beb-3321-4e36-9d3b-c4eb0063a92d", "value": 168068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691384404, "uuid": "5077728e-e650-47ec-bf0e-bf4dbe11c88f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384404, "uuid": "d95acf99-af03-4f31-9eff-dfc9166b4dc3", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3327beba-3509-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691402412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402412, "uuid": "aa98fa50-213a-4a23-a858-5dbc352a857b", "comment": "Malware payload (DarkCloud)", "value": "f85572b352fcd493845192f3ad5826a5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402412, "uuid": "e7ced4b6-413a-4545-8a60-a9ec56022acf", "comment": "Malware payload (DarkCloud)", "value": "b9e6488c93fae6e4ad6d346070252c97799fa2a32dd6d850d18e05446ec6968c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402412, "uuid": "9271e6c5-f7c6-4912-b8f6-3aed2cd642d8", "comment": "Malware payload (DarkCloud)", "value": "adc53e42b2e5d71b1ec447e6242d35cc9d481b3b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691402412, "uuid": "9e05e84f-9bbd-4b45-b6c0-dd2598213de6", "comment": "Malware payload (DarkCloud)", "value": "018edf360fb713d5ca06587bc6990c95783359876efee010e6f4498ff69d19dd999354fb64fc0aa5d95cadbe292ddcc1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402412, "uuid": "76180c77-082f-4bc8-a198-e7d8a1118e20", "value": "T13CA42926EA51602EF153D8B1E9E4625B68196E7A169CEC2BF7855F0831312D3F8F031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402412, "uuid": "b19d24df-f9b1-4d49-be5f-1d3d1b20c1e2", "value": "46dde7a8d2b198890050830beaf551ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402412, "uuid": "556f88fa-2f62-4b1c-9e3a-e63a78f66fcf", "value": "12288:DhrJddndm3AsXQJDKEKBBhtQHlfy9yECnjYKkJj6GmZU:XnwLNBBhtQH9/Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691402412, "uuid": "5d54173f-59f7-4870-9bcb-160cb18ebb09", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691402412, "uuid": "eb48d70d-6c22-4716-a25d-7212227dedb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691402412, "uuid": "eab8f268-1cfc-43d7-9725-51a40fc618c8", "value": "b9e6488c93fae6e4ad6d346070252c97799fa2a32dd6d850d18e05446ec6968c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afae7171-34f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691394031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394031, "uuid": "d383ef33-0086-4e0b-8b4d-25d9f7100b93", "comment": "Malware payload (RedLineStealer)", "value": "b6e604a44fada526ffdff314ba34953d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394031, "uuid": "ae48cce2-55af-4bce-9614-4878ca6277db", "comment": "Malware payload (RedLineStealer)", "value": "b9fe51977ac529e23d9f9dafae8a50429af6c4b847c4002c9300c7d47631bf97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394031, "uuid": "cdf513ac-a2aa-4de4-954a-f8d5fe793890", "comment": "Malware payload (RedLineStealer)", "value": "290f77daa7fd6f3463d4b605c1c3c32e442300f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394031, "uuid": "aba3234c-733b-4554-94fe-f3e4dcce98d3", "comment": "Malware payload (RedLineStealer)", "value": "e306213636744e86664d422096288f43dc762d1e698ab92b30a897dac407417bb89fbd4725662b5d757eea2fad292849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394031, "uuid": "59235c7a-9fa7-4ea3-9504-118eaef8aa69", "value": "T1E6A45C0392A33D50E52ACB728E2F86F8765EF5508F593BA53268AB2F05B11B3C173715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394031, "uuid": "3198546a-c667-4409-bab1-92cec438c163", "value": "4472ef7ff17466415618a97438e0e32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394031, "uuid": "60c1e39d-ffd6-4761-ac74-56f7d0a388d6", "value": "6144:F2OyTwdoALugAuMTuHg9CKwrQMAjV8YJdGXu029dSz8q0cZZMzhoe:FbyTw8gyuH+CFUMAjaYJdCFIIsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394031, "uuid": "b8091ce9-ffaa-4620-82ab-ffc36bfa8fa5", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394031, "uuid": "a9411f22-ca3f-4804-b1e1-8ffca87f749e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394031, "uuid": "94fb8753-aed4-4217-ae97-284b7a6af0b2", "value": "b9fe51977ac529e23d9f9dafae8a50429af6c4b847c40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf34e7b-350d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691404173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404173, "uuid": "a27b9113-8c84-4fb7-bb5d-2a203a315a3c", "comment": "Malware payload (ModiLoader)", "value": "6b14053c37d26db86fea40e715476db5", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404173, "uuid": "7f302a86-ff18-4d4d-bafb-e9c3e0092cb4", "comment": "Malware payload (ModiLoader)", "value": "ba336f21e7e90be04e5e8837505bab7cfbb4f858aee659878dab03a9eceb18f4", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404173, "uuid": "ec33673e-17d2-45ca-a02f-1a081f5776c1", "comment": "Malware payload (ModiLoader)", "value": "0bf1b0057239f53e9413c4fa74432f6673adb8e5", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404173, "uuid": "18e8c92c-2c8c-4217-b1e9-aba57d7eb476", "comment": "Malware payload (ModiLoader)", "value": "7d7dfb0a36fe56050b7d17fb5545321aded10f37337983f443cb07af5104bec8c44d36644b957ef9409b9e64124e283e", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404173, "uuid": "71991490-5f15-4c3b-ae1a-eb4c4766b642", "value": "T1E5D433D2EA1CD590687F860DDF8D5F0B28FA7C18097E5A82810F1B73BF905912D1A76B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404173, "uuid": "e9557943-7e57-4f0f-b73e-887d4595f4ed", "value": "12288:2Im2zMF2mFX783UiB4AzCvtbc5DO1942MPAi6tiQT8U0TiqBdY3l:f8FL8EWCeDK42MPQoU0jBi3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691404173, "uuid": "a5287e1f-ddf7-49a3-9fef-2a9ec3160e08", "value": 621459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691404173, "uuid": "af943eb5-3740-487e-b5b6-b9b1a0fd22e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404173, "uuid": "7375be94-deac-476f-bfd4-43fb8635ab48", "value": "INV_SDI2109_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40db6854-3535-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691421333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691421333, "uuid": "ce376561-56ac-4038-a080-8aa37c4d9ae1", "comment": "Malware payload (Amadey)", "value": "3bc6d385a3cc4cc233f24f618cbcf9a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691421333, "uuid": "bebedd8c-2e94-4b9d-be4e-1a0a50347bba", "comment": "Malware payload (Amadey)", "value": "babdeee3a3ada858dd39eed6db285522adc63f257acca53b5185b16e59b5f5ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691421333, "uuid": "d4690fdb-5025-49b5-b0d3-d84e8cac2610", "comment": "Malware payload (Amadey)", "value": "80ce706835fae883b68566485ee15a7489dc7560", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691421333, "uuid": "a1e58c6d-0a52-498e-97c5-376111f2e990", "comment": "Malware payload (Amadey)", "value": "854fb0cdb15495878fbd1b8d7965e6f18f0f0044908af943069cd8553eb14461f20c172498cadc0420c62c8f07acfa30", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691421333, "uuid": "3020df32-9c0b-49ba-994a-f907cfcff3be", "value": "T1486439417942C032D96061721BB5BFF2C59D6824ABB049DB6BC00F77DA212E77A71F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691421333, "uuid": "cd1634dd-9f2e-4641-b3f7-d44f29fc6c14", "value": "e828679bf7773c76d009985e1c81e0f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691421333, "uuid": "4a1f6337-ab40-42e7-ad05-238686c087bb", "value": "6144:DKxtzzvpX6epZQhvyIp8HHn+14D8Ki/t6utLYhFAOlSKzqJ:GxtzDzPQhvFp8n2t6utLYhF/zqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691421333, "uuid": "eaa33d40-1b4d-4746-9bbc-6aa6fb4316b5", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691421333, "uuid": "42b1a567-fd96-440b-88c2-de16ac1b07fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691421333, "uuid": "ea6cab8c-25e7-4886-8ade-60926a7fee9e", "value": "3bc6d385a3cc4cc233f24f618cbcf9a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545c8a35-350d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691404186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404186, "uuid": "ef0bec33-697c-4815-b8af-44536a0457dc", "comment": "Malware payload", "value": "f0ba8b6ab407e8c0c70f78d5f7cf14a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404186, "uuid": "11afd6f9-c5e2-44eb-a4b3-28128fb4ff6d", "comment": "Malware payload", "value": "bba88bee0d55a24aa33fba3a65c28a1e4acad47c8f8320fa621e4a09756efed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404186, "uuid": "909362e4-295a-43ac-b0f6-7dca596bdc9f", "comment": "Malware payload", "value": "3c566fa61b629b4eaaebb2100a017c732d213066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404186, "uuid": "4516775d-7a26-4c3f-9aea-9ad969be650d", "comment": "Malware payload", "value": "c5fbb37ebc24f9a457415d1c5f668eecff1df7a8fe5299d4137993f87c1e1a93f7702287d3e8751a9d922d9569de2330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404186, "uuid": "599f4591-3013-475a-8efc-01b1ca625062", "value": "T1A646123BF2A8A53EC4AA1B3246739250997BBB51A41B8C1E07FC344CCF765701E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404186, "uuid": "4c781f11-7f64-4b04-acbb-377dd755f3b0", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404186, "uuid": "5e21ed9a-7e19-461c-90c0-f37eeca78fa1", "value": "98304:MkLsS2ySliRp2gyQUnIM6X/JM4ANgS9+pQ1f/PzWZQih0sEjFh:rR2ySlVdNo/JM52woQ1f/rWZQicjFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691404186, "uuid": "5b08fa2b-b915-476c-bab6-bb7668773a10", "value": 5550368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691404186, "uuid": "77253e0b-87df-46ba-9c71-967c22052888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404186, "uuid": "22bf57ad-5e0e-48c7-a241-e501f2d6f3f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa97203-34c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691373004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373004, "uuid": "5f3391fa-bbf9-448a-bf40-a0855924cab2", "comment": "Malware payload (Mirai)", "value": "1a2cc8feb05cdf2e3bbaddb12b711635", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373004, "uuid": "baed4e4d-57c3-4854-997f-96281bf2b037", "comment": "Malware payload (Mirai)", "value": "bc87be9203dbad742f093cd964391f79822ccb78f5deb47637ce861eee14a1b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373004, "uuid": "6d2fc160-e902-4cba-98e7-0802ae5961ef", "comment": "Malware payload (Mirai)", "value": "8fa93e22aeeb6032abe29fa76023b166ae78097e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691373004, "uuid": "d41962a5-15d4-42a9-8630-4414f31f671b", "comment": "Malware payload (Mirai)", "value": "50b42d69731ce5b0649dff889bce826714bca809851e117167370f316a805904a2c21c594caceae35e5ab2caef8db8e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691373004, "uuid": "d0ee94dc-7a4c-4925-8b04-d526e3dfc9ba", "value": "T124C2F175E2AEC2BEC4A5733C20485E4F8A068DD04F5DD2893618275C9FEBA38593DD2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691373004, "uuid": "cbf11a71-87c1-4903-9872-4e8cc860f8d7", "value": "384:Mjv66YgiokzDM366q1tl85WK1ufV9suqK0eaNpVIEWW+ZaWzatT+v1Rm:e66Y4hy8uN9sK0PINW9WzJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691373004, "uuid": "718fc88f-3fa6-4454-bdac-48ba140f3511", "value": 27176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691373004, "uuid": "0aadd1c4-8dd9-4b52-989b-2e2cee0185e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691373004, "uuid": "267b732f-4edd-4b91-9b08-197daa6d54c6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c44ae94-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691394777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394777, "uuid": "f3716105-2160-4884-8d10-2096b072c7f1", "comment": "Malware payload (AveMariaRAT)", "value": "6d1246b259e981a5592d7b4d32b5db30", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394777, "uuid": "97d477fa-b1a2-471c-bff1-8a98fc0f7eb9", "comment": "Malware payload (AveMariaRAT)", "value": "bcb2a3d38a11a7452791360953401c9f3e0f5aa2b19a0160a0573c15090c8be6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394777, "uuid": "5a602830-5048-4c56-b1f5-cbb1b079e599", "comment": "Malware payload (AveMariaRAT)", "value": "e999020c363dc4236181a50dfa665212d8cfc0f5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394777, "uuid": "e3e2153f-e125-48c7-b9a7-a3e607a014f3", "comment": "Malware payload (AveMariaRAT)", "value": "7c9bb0239ced3d0dadcab02810eb72314b908020843cad060c2bf4c201d72628290c435d965689e52f028b51dfd56a6a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394777, "uuid": "a251de21-deb3-4e29-b1e4-88c709a706b1", "value": "T190F46B2072A54F1EE13EB7F65740A20843BA5ABE613AD6554DF261DF62A1F08AF00F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394777, "uuid": "853f32e4-4e41-406b-8ee0-3ad439668340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394777, "uuid": "f72b208b-960c-4b01-8601-6b01b91c98cf", "value": "12288:yQdOXTB4QjONUEQI0WHuGavF3IVzbqrhTqGB199e7VBq:AueONxQBWHu3JczbQRqGlI3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394777, "uuid": "6433f40f-1945-417d-9d5e-c5ccf9185d94", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394777, "uuid": "60c6e0cf-1aee-4294-9ed4-6dc73b3e6890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394777, "uuid": "845249f1-5a2b-4cc8-8347-97935b1ff9f3", "value": "AKAY LOJISTIK & DENIZ TASIMACILIGI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e393c81-3507-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691401545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401545, "uuid": "d35e8cb4-08f1-4215-9c44-e5e9789ce870", "comment": "Malware payload (GuLoader)", "value": "8a59be78d252751513a832a638a26cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401545, "uuid": "4b554639-006b-4e8f-98f5-2065125fadc8", "comment": "Malware payload (GuLoader)", "value": "bde5a7b95d5a6fd6a05e8ff2e53e2d15efcf2394e58e10889e4de7699eee3a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401545, "uuid": "ae27b790-e4b1-454b-8d3c-221fe785b8cb", "comment": "Malware payload (GuLoader)", "value": "d52cfe475b8391ab2c587bcdeacc7361637e5b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401545, "uuid": "a4c3042d-950d-408f-aa02-3f2c6f5d6426", "comment": "Malware payload (GuLoader)", "value": "b27c4556c7a2666ff9bc58f56b39080fc68e87a9db32ce6392880f5fe0e23c8a845ef8ea87df13f2378695648e7fdbed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401545, "uuid": "51c0dd70-7667-4cc1-ae20-eb6ed01c95ec", "value": "T1EB54078462A2F64BD7410B70D9D0E7B925B76DF19901422E6EAE36F85C3FF290DB0172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401545, "uuid": "660f0286-c597-4954-96dd-6367e8ed7f20", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401545, "uuid": "5c3279ed-0987-46bc-8297-511161077a7b", "value": "6144:ajC8w75wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww5w5wwwwwww:z8w75wwwwwwwwwwwwwwwwwwwwwwwwwwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691401545, "uuid": "0b5c3ae9-d32c-4599-b99d-7eaba1e54d1b", "value": 293542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691401545, "uuid": "2b9c8ed6-3c99-46bf-bc21-888653429602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401545, "uuid": "eacd8518-ddfd-4771-b474-bfe816b3bada", "value": "bde5a7b95d5a6fd6a05e8ff2e53e2d15efcf2394e58e10889e4de7699eee3a8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ecaffc-352a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691416865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691416865, "uuid": "43b303c9-c8b8-4592-b75d-51464a26bafe", "comment": "Malware payload (AgentTesla)", "value": "5a08ba81444a3984161787236f58f064", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691416865, "uuid": "75d31b3b-74fc-4407-89f2-a68c7d797b5e", "comment": "Malware payload (AgentTesla)", "value": "be9496d0210e6343ea547889586015ab09bd8d25061f154a3f9f0922ea5a61de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691416865, "uuid": "b58aa714-b151-4d8f-846e-04018e9b8108", "comment": "Malware payload (AgentTesla)", "value": "f0b0d58343fa37e5da5de564d3596031dd4e38b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691416865, "uuid": "87cb163e-4c05-449c-a8a4-08436050592d", "comment": "Malware payload (AgentTesla)", "value": "f26d556934f9c2388aba3a8fb1c91f85d43055d2fe26b286d53ad46427894e851c58277d663950162363c22073f0647d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691416865, "uuid": "0ed62d7e-63f3-42b0-a531-bd11591aea6f", "value": "T17ED401071D19F620C568877B367C466C03AE2D5EBCE5E24B8D6CB8E9E372F4A8525C43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691416865, "uuid": "b1a655a8-b8cf-4046-ad13-308c4d851734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691416865, "uuid": "06bf4c38-6a20-4694-8247-440e799d6d6f", "value": "12288:AS3U80qxh8TMoRPxSZGHvEsxNTh2XAwevIKteA:R3UVqxURRZSSEcNTMAwewK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691416865, "uuid": "ef7f89ff-af05-42db-aa15-4fbe77710eee", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691416865, "uuid": "738203a5-f5b3-4638-b811-ec8bf541e087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691416865, "uuid": "4414e52e-f64c-4706-a110-91340bd7e3d9", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54a0d75-34d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691378122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378122, "uuid": "fabd2946-866c-449b-85b9-7ebae87334e0", "comment": "Malware payload (Mirai)", "value": "0da49147208528ea5d0951e958cca0bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378122, "uuid": "a8497e9b-ad99-443b-95e3-4dbc88fb322e", "comment": "Malware payload (Mirai)", "value": "bfbfec1a34825063a5c20f3747c7ec3d94bcc6bb9ddd5b2979f7de799f3088ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378122, "uuid": "fb9ca7cc-95cb-4a5a-a7d8-c7b33009e51a", "comment": "Malware payload (Mirai)", "value": "31db1cb2b3e601d57419d27da501225e4bb2e6dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378122, "uuid": "0696bcd1-9b65-4631-890a-fa0fbc1924ca", "comment": "Malware payload (Mirai)", "value": "e14f039466f496d0988def71fed5796a0a09877002523111ab395062834f81ac148f8d71ade0d92f02ece29daa022074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378122, "uuid": "97768f45-dee1-4055-8af6-bae66646a55d", "value": "T1F3431955FD819712C5D52177FF5F428C772A4398E2EA3303AD2A6F70678B8660F2B602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378122, "uuid": "e407c078-b2c4-43d6-9ad9-2a842a0e79de", "value": "1536:SA8QSTMnC9Vn6Bj9jjK6yZ4HL9rCOn4wUUVwlFvyq7:htaMnY0BpqHZ4HZJNVS4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378122, "uuid": "e660688b-4406-46a9-9894-78f164221184", "value": 60380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378122, "uuid": "66476b54-8bfd-458b-b429-10ef77a32fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378122, "uuid": "61834144-2468-467a-ac55-08a17c51f823", "value": "0da49147208528ea5d0951e958cca0bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e09c61c-350d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691404175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404175, "uuid": "a49c4a6a-ad20-4160-8a2c-f2efc63deb18", "comment": "Malware payload (GuLoader)", "value": "b0f9784bf516e684f1e66ec4119b599e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404175, "uuid": "9f9f9ddf-027a-43c0-8b6f-7531b123db76", "comment": "Malware payload (GuLoader)", "value": "c30992da54356aa3a7ee667edbfd9b15029a0470d4ddf41ef1828ecc3ce03a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404175, "uuid": "3ec9d12c-96ab-45fb-8efd-c86896f59a0c", "comment": "Malware payload (GuLoader)", "value": "4066ee81ec65b5d86fa256e2dbf6dea5fd4d4de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404175, "uuid": "f4a04ba6-11a5-44f1-a705-87f60793dc4b", "comment": "Malware payload (GuLoader)", "value": "f5a5b535f3aba7d713a17e9d02920c7f24aca0bdda86b4a439cd3ed0001cfcd1914773426ec20d5a36ff8b663757e9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404175, "uuid": "b08b6f30-20c5-4224-886a-9130f947c92c", "value": "T13474F1847240C767DCE853B211FA4B22CE62EE99F0E6CF572740F25C5A337C99792A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404175, "uuid": "9f0198d5-9a7a-4708-ac14-ccb494f05ac2", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404175, "uuid": "f62d0086-f926-4479-a7d1-912d99d9a211", "value": "6144:UR+xXn81yEnb7IjQTafJKi9T2JXincTEi6QWYmih2+iyN6sRZ8o+SK:sS81yEnbEpfJKi9T29icQ8pmi8+iRsRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691404175, "uuid": "25f6e7f4-098a-470e-a87a-1bc13e5e2733", "value": 345152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691404175, "uuid": "92d963ca-97e4-4ba0-8819-bcd27529cdd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404175, "uuid": "4182ceaa-1acb-41b2-93d8-b1abc55b1ace", "value": "Payment-confirmation-copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e095ab06-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691414729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414729, "uuid": "4c9ff993-b326-4389-941f-becd8411969c", "comment": "Malware payload (RemcosRAT)", "value": "5cd62cdd2803e876f89378ddf6de3901", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414729, "uuid": "a9d055cd-ef5f-42e3-b290-e4f975422a11", "comment": "Malware payload (RemcosRAT)", "value": "c4922ae9cd82a5ddbbaecf2c67d678b533610ba4dd3dc32d28bb8539d2963d6d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414729, "uuid": "a208ba44-4d97-43af-b8d5-f41b180e6dbb", "comment": "Malware payload (RemcosRAT)", "value": "e81eb2ba26d93907a296eff4c243f16d77b3b5ca", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414729, "uuid": "78c670fe-765b-4347-9915-15bad0da6a9a", "comment": "Malware payload (RemcosRAT)", "value": "8dc8debf9c8647d79b50ec58f58a96cc1eacb81d415d8991f1e45d7eb50fc44fb6b3778efe149944ca0a5d175cef36eb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414729, "uuid": "92aa6749-edb1-4e03-badf-6d5a359734e6", "value": "T19D73026DC34F01A9CF6652779B1A1E4542FCBB3EB24412A2306C437533EEC2D96266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414729, "uuid": "5af4017d-28eb-495b-8e37-f61dd537af35", "value": "768:1wAbZSibMX9gRWjzl+fC07ot721/KMUBzCIB6477Ujhj:1wAlRC+fpTUBzCIB17shj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414729, "uuid": "c7700c6c-1f09-4e1b-bc5f-5c4ad1061556", "value": 76812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414729, "uuid": "5deaf0e6-700d-4891-9318-13a7f92b3e6c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414729, "uuid": "3afcd61b-dfb0-4eb7-875b-0f0fcaabfe8c", "value": "PO-7836493.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8046c9e5-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691390515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390515, "uuid": "1d788738-f515-4d64-bac9-1ff667b0bd04", "comment": "Malware payload (AgentTesla)", "value": "f43592635f2c85d29d4f74f6ceb6fb0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390515, "uuid": "985d47ce-fa54-468e-ae13-297d52843de6", "comment": "Malware payload (AgentTesla)", "value": "c584a7b4577576c1cb0ac620970e6158a2a05321f0e301fb855ea8bac76a0426", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390515, "uuid": "383dd051-7937-450f-9490-e309c6032265", "comment": "Malware payload (AgentTesla)", "value": "9e08bc4b9b979da850eccce9561b81a5c80748ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390515, "uuid": "b75fd0a4-00b4-46ad-bd34-8c58963c4c55", "comment": "Malware payload (AgentTesla)", "value": "4ddde2eb321e1884026d9ede2c885f6ca76e086c988a5f8b25942660f5685a27d20552cbb98c80a3ee86e2d1e501963a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390515, "uuid": "742be6a1-d37b-4a6c-ad35-ee198e1de214", "value": "T16B54239100EAC6E9CBD5A152943BC937ECB09DC8FB322108BDB9F52A7C9BD51974B50C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390515, "uuid": "577befe9-7f18-4cf6-9c36-a3e700d1dbb8", "value": "6144:HURnkQhL6IriQQrTE+VVCq2QeQTxg1LcWF5uP03hdZmI:HU6QhJrijj/ZeQTocWFUePmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390515, "uuid": "cbe9b032-7f0d-47da-8de0-31ee492cb031", "value": 280217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390515, "uuid": "b46f67fe-2b83-47d9-884c-2a204e375c19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390515, "uuid": "8f9f9b4b-4474-4fc4-ab7e-2169992376b0", "value": "orderX4500384851.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f9f09d-3520-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691412355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691412355, "uuid": "78b1cfe1-f9f5-45cb-9ea8-0b98605b5a98", "comment": "Malware payload (RedLineStealer)", "value": "3a73b9e74bfa9a8c065184c934109b3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691412355, "uuid": "86a6909e-6524-4bf0-b243-8ae1c7749d1a", "comment": "Malware payload (RedLineStealer)", "value": "c5c5091d652dd13f48601638ed229bb694e4c2bcc40bb37b3afe31ccff8359f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691412355, "uuid": "13bf79b1-bffb-491e-8c27-b8ef7427973b", "comment": "Malware payload (RedLineStealer)", "value": "f0e7c0f02a464f17636b8304127b1cacd3de64e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691412355, "uuid": "b3e6f33d-1fdd-46d5-847d-ebef0b71b095", "comment": "Malware payload (RedLineStealer)", "value": "220f6596c33882f42ea6ffa0f996c3d0b6f7c2f400e34bbe845b0bf73ce25750df6b70518a4e505c4bd20873aa9cc5fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691412355, "uuid": "b18990b4-915e-4b0e-9aa4-59059c055acf", "value": "T138C41212A7E98072D4B1277048F617830B337CE25C709B7B2785AD5A1C726D4B876BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691412355, "uuid": "0faca384-cf67-445c-b638-bfb61e2c8bc7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691412355, "uuid": "c81d97df-2dda-4dbf-b9b8-565b39dd8911", "value": "12288:sMrry90mYGNtpeNZUP/fBghGBWgBYCWZdmO9VLUA7P6Hb:3yzYGNtpegPRmczomwVLUqP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691412355, "uuid": "0c42abd8-e30c-466c-876e-cb250d4d321b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691412355, "uuid": "94028104-a46e-4853-87f0-598cbd71d0fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691412355, "uuid": "736830ec-a63d-4cee-94d5-f844bb47513c", "value": "3a73b9e74bfa9a8c065184c934109b3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4097336-34fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691396159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396159, "uuid": "ba76c374-516a-4d80-8cae-583921db09b0", "comment": "Malware payload", "value": "edbeb43bfdcfceb9f5ec77ae378c1b5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396159, "uuid": "5dbd35c5-b94d-45f7-b7c9-4a5831098f2b", "comment": "Malware payload", "value": "c66299301e77ac9c54523b79af281761168ed40b7b354fc4604c9cc37d767a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396159, "uuid": "7a98884a-3384-4192-ac75-01d04e6221a2", "comment": "Malware payload", "value": "14c15454405248c2b57eee80c238df4306840334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691396159, "uuid": "7440d308-3869-4492-bb76-0fdead535f18", "comment": "Malware payload", "value": "8864b95aee169d4c25b2a5e76351a14676a548b038d06459404db1aa0f2dc03228ea338972f0f3a00bdda81760483cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396159, "uuid": "17349f0e-b4a7-4b55-9532-674dad7a4ef8", "value": "T1A684129273C74B00CD2524BD44EF823A07E16FC369378AD9BF0C36A95E16A139F96946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396159, "uuid": "63ba63ed-633e-4100-b2c6-0038ee2b6dbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396159, "uuid": "2972ef51-c7a4-440b-8d76-a6ddfdab74b8", "value": "6144:MiyrlK2EmkseqwA1Lxl6dONR8NQLkNNL66hUMK/W3dDUyhU2rV:5yrlK0np1l/g+LkNJDhUp/WtIVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691396159, "uuid": "fffb8c74-790a-4465-bfe3-97daa693ef19", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691396159, "uuid": "17c27930-5115-483f-ad6a-01b1f4fc8696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691396159, "uuid": "7b67957b-f93f-4948-a386-b866876726f0", "value": "c66299301e77ac9c54523b79af281761168ed40b7b354fc4604c9cc37d767a50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9027f9f5-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414594, "uuid": "aaa0c25d-e424-432c-a5f1-e3ace6456e7c", "comment": "Malware payload", "value": "5f07fa953f834ac97ccb096cf3ec3943", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414594, "uuid": "8b111841-f5f0-4ef2-8560-4aff0c19450f", "comment": "Malware payload", "value": "c699be2cfdf0ad9b9bffecacd7d8e848a686c4d7e3602e71e50c6ec8836cd7a9", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414594, "uuid": "d5574331-f0b3-458d-b433-f2246b71569a", "comment": "Malware payload", "value": "9c958de4b5c70242c8bdabeed169f7a5b8d8336e", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414594, "uuid": "a7001750-b67a-4b5c-b469-b46e37d56a48", "comment": "Malware payload", "value": "d7e3c1cde631d553a2d3ca0a262a77ade1519e731e282a7489fc7c8b7ce2e1227161b1b5ff85cb7cd0f1bda41bbd4b83", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414594, "uuid": "ea2b4fe6-ed2b-41b2-9a05-d21598425f96", "value": "T1A4E433BCC1339E92D9BDCF59BE5EF0CB100C16DC2B52F6851A68C92D343A5C29592ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414594, "uuid": "0057d73c-8707-4534-b3b3-897f04ad6be6", "value": "12288:5O0hoK0GZ3OpXFIie6emx/l2IIFiAYxB+PD/1C1XSF59Gf1ST2DpVH6EDNl0WcUh:U0hoKpZ+p1A6eu2IIRYz+PDcXO5KSTpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414594, "uuid": "e05a3c8c-95a7-4327-a0e0-418aeba58462", "value": 715597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414594, "uuid": "cf648ad3-4b3c-4934-b9d8-5d71edc6eeef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414594, "uuid": "0d4f0b0f-49e6-4ceb-a20b-a3708abf5f7a", "value": "LAGOSTENA S.R.L. Purchase New Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60610f7c-3500-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691398622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398622, "uuid": "45e65a4d-c465-4a9f-9cb1-223b9702a85f", "comment": "Malware payload (DarkCloud)", "value": "6b7cacac637eb7c7c75c6670db8b608a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398622, "uuid": "ef5e4844-3ac0-4772-9cc9-945da96b106e", "comment": "Malware payload (DarkCloud)", "value": "c747e15b4990562db3d61f6464faa2fc052ef2dbe99eb1126a1307ecdceab61e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398622, "uuid": "42de3fc5-436c-4a99-8c2a-68cf8f28fa05", "comment": "Malware payload (DarkCloud)", "value": "1f4f801087f43e42b036698e9d1ee5e6950d3802", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398622, "uuid": "2c0da3d6-7ce6-42cd-8a95-7b17eda6f5e5", "comment": "Malware payload (DarkCloud)", "value": "449d5002cfb1d1ad9d3f43769fb40e9d295deb65db0f275c8e4a561e9c520270faa62cebf18ef28f593dd3e2457d7f45", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398622, "uuid": "7288cce8-cb80-49cc-bdc7-c62411277223", "value": "T1C3A45D26EB61602EF063C8F0F5E5925768996D7A12A8AC27F7815F0935311D3E8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398622, "uuid": "8b61ef52-ac01-4968-97d0-e0dd49bd06c6", "value": "1bda00bd756d4ff86cecf1c4d4088488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398622, "uuid": "0d407be3-ba30-43ab-b078-0c4459d0c4f3", "value": "12288:iVGVbzVTvd5/8xmIaCMBUt8ztJ0oKQiSjYKkJj6GmZU:/dViuztJ0oNxYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691398622, "uuid": "896d4bbc-942f-4f19-868b-e6473634be37", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691398622, "uuid": "880b2bfe-81ae-46f3-8534-767453b5254d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398622, "uuid": "aea63bdb-1081-437e-a6e3-35dc4bff43b8", "value": "c747e15b4990562db3d61f6464faa2fc052ef2dbe99eb1126a1307ecdceab61e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6637864-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691414685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414685, "uuid": "6ff4dfcd-b10c-46d7-8799-0adb4d7a4208", "comment": "Malware payload (AgentTesla)", "value": "9d92efb96db3743b53c645d8acf5697b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414685, "uuid": "b5fe36d0-d0e6-40a6-ba5e-c48a96efd349", "comment": "Malware payload (AgentTesla)", "value": "c87ce160161f10cdcc365345ef885138d741cff464feb748a396ad6af249231e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414685, "uuid": "da3ae545-3fc2-461a-b8d6-d181c162f58a", "comment": "Malware payload (AgentTesla)", "value": "1f24b88741a1ffa06314a996058568c932f720aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414685, "uuid": "82cbdb3d-73da-4fef-be5f-445fd1541b09", "comment": "Malware payload (AgentTesla)", "value": "88435909af46ce7f7917198ebf4d9b6d4ba2c7b3fe042ef170743703bd2c69189b3a1401f2fc3d624693c09ab2a32eff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414685, "uuid": "cd381d80-dd6b-43cb-80ae-50b46e7f5cb5", "value": "T1EEE41255D068C3A5F9BC4BF968658C350377BEAA5A34E32D0E5974FF2932F8B8421813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414685, "uuid": "4c9e0cc7-4f9f-4d19-adad-dc622603b733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414685, "uuid": "a7759f69-c7d8-456d-8518-a7c3da8a263e", "value": "12288:0t+kVpCbocVYWJZLVu8Yq5bN3Tdwvge1dOkWHAd7sls/s4Q3Ubjv:e+oC8cyW8w5bNG1dTE2IsFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414685, "uuid": "d9cef749-674c-4f57-a639-cbe8c7e2cfe7", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414685, "uuid": "9bddd067-1bc8-4172-9309-4c703594d097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414685, "uuid": "9b97d6bb-85b6-44b1-8cbe-fddde02d17a5", "value": "Fiyat 10243975 forKARDAG A.S..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e66daa-34ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691375523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375523, "uuid": "910eb193-e431-4a1c-8571-93de52a49179", "comment": "Malware payload", "value": "77a78b4957a2f348cac8e07e1c500b62", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375523, "uuid": "2031e123-ad57-4ff4-ac82-2b5aeaf3e9a5", "comment": "Malware payload", "value": "c8cfc8a0c5f47cc8a0221dc424676fe5353fdf01efd7617c72dde92a2b4f97c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375523, "uuid": "7b1be792-3175-4786-9c96-beb525272ceb", "comment": "Malware payload", "value": "764b8400b98f02a9c2c1dafa32c983b2db3cb372", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691375523, "uuid": "fd2bafd1-1a0e-49bc-ae13-cfd2f2c11798", "comment": "Malware payload", "value": "58350f1d2183281868c778016c8d8ac5452c9b05a610ee2bbe60238137da09c9c419befb00560289985773edb86c5f8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375523, "uuid": "219c339b-2a32-45cb-96e8-69e193985fc5", "value": "T1B5743B00BA50C034F8B710F8467992BDA91D3EF1672890CBE7D96ADE5B356E4AC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375523, "uuid": "21232830-b7cd-4c9e-850a-aae24f32bcb3", "value": "acebcac52401f02699025becc188d242", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375523, "uuid": "b95edaf4-aa56-4d09-b110-24c3fd02f615", "value": "6144:wk40RScvLlY5NCdUPRqWt8lkTZ/icmNUp3p/Bvxmvk0e/HPO1oWnm:7RScT+5NCdUPRf8IiWpr8s00vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691375523, "uuid": "bda68e81-a912-4ef0-92a6-816da4282380", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691375523, "uuid": "78d22540-ecf4-4b1b-8725-55692c1b54bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691375523, "uuid": "d731f835-0214-4fc8-8620-ee2760370bbf", "value": "SecuriteInfo.com.PUA.Win32.XchouWallpaper.B.component.8575.4442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845bb04e-351d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691411138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411138, "uuid": "9f0a5a6e-c53d-4fcc-a5a2-f5b54e39df81", "comment": "Malware payload", "value": "c57ea1e8c7c6b8c899262be870bccaa0", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411138, "uuid": "f54288b6-d22a-443b-b38e-c4ada24c41d9", "comment": "Malware payload", "value": "c9ece6e3ee4436ad7ba3fdc8532b6e27d6ad94fd2253c06cf14f49f12544b860", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411138, "uuid": "acb53500-7bb2-4bb9-a9aa-8a3751114bc9", "comment": "Malware payload", "value": "c9540bfa21526d10350b45195e17aed6028ffb98", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411138, "uuid": "a786ac20-df29-446e-bcf1-acba587c2794", "comment": "Malware payload", "value": "f456e239a15fb4439b4b5336656e5b1a98e9868c4bad67084f0c1c5d0a37f730fc91cbaca51fa02f870bdca60453bbfd", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411138, "uuid": "4ec10628-5615-41bc-b83f-1f009a8b69d8", "value": "T1A2C02B10C31DCC39C02B490C4A0DCDBDE80310C1316BCC7183D01A8CFC4203B4E884D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411138, "uuid": "ea337f50-a743-4803-9914-b98abcf91d36", "value": "3:HRAbABGQYmimiLXIhzKEgdOIFdUo1YSo/QJ5LIyYesbBSn:HRYFVmizLXczfEOydISoIJ5LIyYesbBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691411138, "uuid": "fb174b5a-ab5a-4589-867b-11d0ce1820c5", "value": 144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691411138, "uuid": "adff353a-f424-4fa4-a52e-41a03f42ab72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411138, "uuid": "6282bc2a-e2d4-447b-8985-f570e5b20f0b", "value": "stable-enlocal-download.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e2c331-352d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1691417981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417981, "uuid": "e08ff6af-7c3e-44ea-bafc-cca800d5aedb", "comment": "Malware payload (Stealc)", "value": "0dd1af9b07e03f3dac542057269e100d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417981, "uuid": "cfc07914-d673-4332-b9b6-aa41b904c483", "comment": "Malware payload (Stealc)", "value": "cc4ce27b042213058ffb13a5078b681dc99e516fb2861b8b3637a25681fd15ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417981, "uuid": "cd84fc7e-ba61-48ba-bb21-3f3c059d1924", "comment": "Malware payload (Stealc)", "value": "3c6eaf89a9b67d33136f27e81ed790a9e1aeeb5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691417981, "uuid": "db38cfe2-d63a-4bf3-9329-92cc1e523889", "comment": "Malware payload (Stealc)", "value": "dfe44bfe0b6f12761fadee17c4fb848bc851f1516680d3ec4a346ae85a23ef8e5872d94334d6d8ffdb3e9405be968e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417981, "uuid": "cb885b51-7e8e-421b-99a8-d13ae2286e2d", "value": "T1FBA3D500D940642EE1A141FFB99E5FEAE82C7AB51304D0C3EBB1AD7635E50F664B056F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417981, "uuid": "a26f3b14-697b-4973-9b35-7e9b5c65b5ac", "value": "cd99bce8ebad6bc5866d19d9d387c282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417981, "uuid": "7115eac5-bbe1-4f0e-8f38-5f6ba073cca2", "value": "1536:FO7s7wqqGfdXfbMny0eDEgU5ZOw9mbNFG7x6pt9Dvdp8R+jHb546+qUlE4SJrIOF:IsOGfBMy0117esKhpV46+8raX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691417981, "uuid": "efaf2617-c5f0-47b5-ae66-89211f9a00a1", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691417981, "uuid": "b025e6ff-e5e4-4c53-b60b-163b41f8b8c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691417981, "uuid": "bdce72bb-a05a-4916-91f2-0c0170ed9c15", "value": "stealc_TestBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bcf81c-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414253, "uuid": "b4ccb18d-bfbb-4fc9-8480-c7f8823dd424", "comment": "Malware payload", "value": "697374394a3ba8c87d8ef536a7a19505", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414253, "uuid": "3c3a8a9b-d992-457d-b912-8b9b54fe98d9", "comment": "Malware payload", "value": "ccee5cbce490aca8b6c3b85ae4173957c5ea43fa13a1d4ec35208486ffc10a33", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414253, "uuid": "01129a44-6082-4581-8989-508426eb55d0", "comment": "Malware payload", "value": "abcac54b909b989bf82fecd099622390832febe1", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414253, "uuid": "acd3a602-6d57-4730-837e-cc3b623b359c", "comment": "Malware payload", "value": "a2f07cc729df47843a70ed6e9db2d32b66e60454376f937d6bb7d6e675182fa071350ff8fd2069fce2bd9b766c2b25c1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414253, "uuid": "2e23670f-f2f6-41b2-9ad9-441aedc5511e", "value": "T118B37226BD52C61BC648C7314CE79BB5F37AAC068E5B42073658B32E3CF3A90A54F255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414253, "uuid": "56ef67af-6ef4-4a9d-af52-20badbec26b3", "value": "3072:ZrXq/NdUrA6jRtguK7QLP5mvrF0oQYn4pcf55+Y2mqmst9PG/M+8wOX91xCk5vnR:VXq/NdUrA6jRtguK7QLP5mDF0oQYn4pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414253, "uuid": "873f4549-4074-46e5-9233-d3709bc523de", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414253, "uuid": "bf4e63dd-101b-4758-9bfb-76b3efea239e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414253, "uuid": "d6b81c99-5207-47c9-8bf6-6fce46d2b532", "value": "20230805_EF\u7d1a\u5411\u3051\u5408\u540c\u7df4\u7fd2\u4f1a\u7d50\u679c.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebe35ad-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691414591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414591, "uuid": "1048af19-134a-4ecf-a3cb-c92c5de7e583", "comment": "Malware payload", "value": "6950cd4386ff4fd8578866f00c1d93f0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414591, "uuid": "08d16343-3d71-4950-9d07-2f7cc7adbfe2", "comment": "Malware payload", "value": "ceee9ac6328507524e729785fec3fc1d6a642c6d0df85a81612094130d0af6d0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414591, "uuid": "fcfb3f9d-809f-4a60-8cf6-9b1c19faa1eb", "comment": "Malware payload", "value": "c1fb423a9e5f4fda9a9398fc3b525db93f641cda", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414591, "uuid": "3b8adb10-9755-4cac-8448-2da57ec1bf89", "comment": "Malware payload", "value": "379b72b262ed6c14a2e95aa5a00c0a07b1640745539ec2a17b8e5455de397eda99dc72684d2048cf95ea4e35aa8a250a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414591, "uuid": "5e966086-8c62-4b8f-b0f8-f21b4edd97bb", "value": "T1A0D423E6D9110201435AD4AAA658E21BC7777C9C73CE37C3ADA3EE5CCBE21D3A611417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414591, "uuid": "d78caa9e-c8d1-4104-870d-07565f108580", "value": "12288:zPkTz/kl6btxOgBeAwAwluSCP4fJZzUhZ0rAaUIAntmW6wUfTF1+:zg7kl6mqiQ4fbU/0wQW/UrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414591, "uuid": "34c73169-74c0-4711-a787-3ab2ec2e55a1", "value": 652757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414591, "uuid": "016863bd-e72e-4577-bda5-28ae433c91ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414591, "uuid": "fb59d981-8c17-464e-bd66-36afcf3ad624", "value": "Payment instruction - transfer P-310226.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d68d3ed-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394779, "uuid": "878e9c0f-5f0f-48c6-93f1-bbe635473937", "comment": "Malware payload (AgentTesla)", "value": "a59895ad417cdb55df931ef643ba21ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394779, "uuid": "64b6e7f6-6fc7-45dc-bec1-fd50119f368d", "comment": "Malware payload (AgentTesla)", "value": "cf0cf0ffa5409da70c4592f55ff280e3baf879a5c090f488805209141c9e4616", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394779, "uuid": "d34b2fb8-32f0-4fcf-abc6-f0e16be301a6", "comment": "Malware payload (AgentTesla)", "value": "745283d866f284efc4aa1015aef78c4866f1c469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394779, "uuid": "0ab602d5-7193-4a02-b3ad-15174ee01a3c", "comment": "Malware payload (AgentTesla)", "value": "a42766efe723a2b65d62926a18dbc2f1d9baba23f3d0742ca2b7c683a931944d508618dedb6fbbce2dbf9f35e68828ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394779, "uuid": "d61fdb4d-78f9-4abb-9324-a5e4ac4716f7", "value": "T169340F037E48EB11E6583D37C2EF6D2857F5A0C71673960BAF48AF652941243AC6E72C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394779, "uuid": "cc721d33-44a0-4be6-ae6d-f701fd5f9ff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394779, "uuid": "cf59c91f-5e12-4c58-baef-231a8e5ca76f", "value": "3072:uR0lkMeH/vucgtbdNdlJ9FCrWuhA5/Ov:B/uXucgzZJ9FCrWuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394779, "uuid": "f5a42930-408c-4a0d-8138-15539d0e9302", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394779, "uuid": "9e88f1db-e4a2-4b83-9d5c-e36fc186e28c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394779, "uuid": "b9538588-f708-44ed-b38a-24104db7d57c", "value": "cf0cf0ffa5409da70c4592f55ff280e3baf879a5c090f488805209141c9e4616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4222adfd-3534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691420905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420905, "uuid": "9692a52d-6fca-4ef7-af04-0c5cc45096da", "comment": "Malware payload (Formbook)", "value": "50b93bbf85541dae736e4d2e5454b062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420905, "uuid": "cf5d3870-0b50-4d7d-890c-b9c98af06d22", "comment": "Malware payload (Formbook)", "value": "d0331b41b50c6134c07ad1ce0b33029ab18ca28e340577728e7818c2d1abeba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420905, "uuid": "140f9f7f-9a1b-4f90-ac4b-2b99c7c9cd08", "comment": "Malware payload (Formbook)", "value": "236cdb26f9f24c590247fd45a6c6affca29c2292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420905, "uuid": "c514ca38-f977-42c3-8022-9fe911eb5ff7", "comment": "Malware payload (Formbook)", "value": "9878032df2feb67a69cced1c938e40d8b59a0a86c6eaee0dc3fecac165b77f8f9035881377cc7ac1a39e077def15d8f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420905, "uuid": "92486f71-9e0f-421f-bac8-3336562fad7f", "value": "T1B8C4235879AD87B9DDD967B27C2C6CAC03B6365E1010E735AE8258DF1102F0EDE2194B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420905, "uuid": "80872a55-c61f-4497-bd79-d92154f00210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420905, "uuid": "e9ae1af0-5c58-44c7-b8ae-06002e0ce55c", "value": "12288:zdZJucvEjxS+x4VWgyI7a5QlvSFMSTtmOklOTzHHD9WSN:ZCcaxSc4EjIYUDY3p3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691420905, "uuid": "72cf2823-99e3-47bb-8b3c-67cb207fd0f3", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691420905, "uuid": "b1f82f75-59ab-4f31-bf30-7df3952fdeb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420905, "uuid": "f66d1813-044d-4ef8-979e-fdba5c91d450", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa675bf-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691372475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372475, "uuid": "b926d7d7-59ad-4f48-9a74-4021d8661172", "comment": "Malware payload (Mirai)", "value": "66ac9db81a9bbd32f9bb6868504a930a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372475, "uuid": "b8b9fc99-2440-494b-b8fd-0406377de5f6", "comment": "Malware payload (Mirai)", "value": "d346ac937e76f0a2df47c68d018d57add14db74f0718bb4629e25d36659a66cb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372475, "uuid": "2a35409f-2525-46cd-9fba-98100c8a4caf", "comment": "Malware payload (Mirai)", "value": "9805fb5b7546782ceea8fd326b43cb5332830470", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372475, "uuid": "246938f7-6931-4c0a-8e65-5e3af43682b7", "comment": "Malware payload (Mirai)", "value": "90e77efddb037741db8cf172c10bd68a5f895ca7054288c077a26dc6440b454779dedb17bb58a3a1089bf467705abaf8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372475, "uuid": "40e5d40e-17d2-491f-b4ee-1ae838ea323d", "value": "T19FD2E1A944E7F6BCD0A6A5B6003D06D5FDB6B256C12917B708E86076DF570D80E30DF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372475, "uuid": "bdf55e93-1a99-4d3a-babd-bce4f0e5588f", "value": "768:bYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBE0ySx0sS:bYJdJZiy1aBnQfTqBTtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372475, "uuid": "1c3d98fe-a112-436f-8ee5-58a3caa1bbc7", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372475, "uuid": "7ac9ec56-b142-4844-acce-38fa02cbaedb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372475, "uuid": "8a7ddfb9-c939-4bf2-8db8-ce27acbcdba9", "value": "66ac9db81a9bbd32f9bb6868504a930a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a5dafb-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691372460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372460, "uuid": "03c5fb57-3c58-470f-be28-5d9b5295c332", "comment": "Malware payload (Mirai)", "value": "18bc57234e7d19e17b2acee8122de226", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372460, "uuid": "96d4d5ce-ea01-4670-961d-0510a05fd385", "comment": "Malware payload (Mirai)", "value": "d4d0f1141cdcd2aecd3bcf01d33ab0e969d6e42abc0e3861ae7fb75a32780405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372460, "uuid": "ffb4cd72-27c4-4716-a7d5-a60b68bda249", "comment": "Malware payload (Mirai)", "value": "9c6f37556d200bbcfa25848fdbdfd0ff990c8089", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372460, "uuid": "25ebb2a6-b3e9-4ebe-b702-acaca9d89ffc", "comment": "Malware payload (Mirai)", "value": "a38d6bd263c146cd713a672df8bbf46d2f5e078bccc255720c8994c32186d33281423be132f66c2de48cb125632cc9e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372460, "uuid": "5db2a15e-0848-4d2d-83b1-e44399edf5d7", "value": "T177B2E1948B91AB06C3B0B435D37CCF925B3B55D4C6F63822272092BC9A4245A33FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372460, "uuid": "a247bb98-fbe6-4fcb-a180-41d624f519c9", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BcKIExhymdGUop5hu7N:4GaKQFH0rs3zWoDDRsjt7LB9U+Bc3WsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372460, "uuid": "9238753c-34e6-45f4-8366-fc521fbfeb23", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372460, "uuid": "0b7355a3-3eaa-4105-a31a-e736414076b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372460, "uuid": "f4a58701-1827-46a2-a4f8-9c8b8fb1d21a", "value": "18bc57234e7d19e17b2acee8122de226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9650be1-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691414663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414663, "uuid": "970f1a2f-2242-4a72-8cb9-0d88dc7393ef", "comment": "Malware payload (Loki)", "value": "a462ed44d4be4cdf0bec5eab470a970d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414663, "uuid": "4035eccf-f90d-434d-9736-e28ce527afde", "comment": "Malware payload (Loki)", "value": "d50ad11cd990b8a013247eaa4f0a7b1b0044720d56ea2c9834d9560d54e90a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414663, "uuid": "55e67202-5993-452f-a916-17a925b1cd2c", "comment": "Malware payload (Loki)", "value": "2380a9feab8c3ea9dc69f58e26b3e50e0edf2ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414663, "uuid": "e620b51b-0826-4fe5-905f-fa838f409358", "comment": "Malware payload (Loki)", "value": "ee5b412e03ebc76520a5d7acb34c14778a4b5734200f29bc74450fb1acc48dd02259c6cd272894deec4921643fef136d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414663, "uuid": "f0ac83b0-a0fc-4c27-94f4-7ca041669221", "value": "T192B41248A09CD229FE3C1BFAB878417D07F5307E1935E2280ED99DEE1922F4E8E51957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414663, "uuid": "ad4d002c-d4c4-4668-9b9e-c90dde223c00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414663, "uuid": "7879487f-d1ee-4f5d-a131-64990b208e7b", "value": "12288:3STS5c+iI+KrxN8DUCtwLW2klmz/up+lNXAzNpGUz:CL+idnRtyWZIGmXAzSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414663, "uuid": "3732d397-fc0b-4819-994f-a72670e81884", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414663, "uuid": "0a774ce4-bd87-4a12-a00c-5cb27f90b469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414663, "uuid": "0c949cd8-2c59-4724-8efb-a9f969df4c89", "value": "UPS Shipment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22931633-3534-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691420852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420852, "uuid": "3c76f2ea-b021-4942-80de-3462ededcd49", "comment": "Malware payload", "value": "4988fc1ca500eb8e9165187ce0f0a0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420852, "uuid": "5b90ade6-35d4-4056-ac5f-8539aac887a9", "comment": "Malware payload", "value": "d50e9eb46c4f3838733224eb3d57b2b1a8aed8fee9434c14bd70d3795e831022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420852, "uuid": "3387d10d-0c7a-4606-a6bf-7c65b919b809", "comment": "Malware payload", "value": "3942adc42ee11f177e722171917ffbabb32cb1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420852, "uuid": "d0ce4a59-04bc-494f-bdc3-49f2c563ca6b", "comment": "Malware payload", "value": "74c1d5106d93f7b89f4cd6ce4507ecaa0d9ae5ef52baee282bab1fe6b925ffc72d83983e2171f2a1183216dcf0efa6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420852, "uuid": "cb3424cb-64a7-4a2e-a87b-db921f564b98", "value": "T150E4A207BA478EF2D34A5776C59B55004BB8DB81B227F71F798A23B625037BBB841207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420852, "uuid": "cd7a825a-4064-4924-962b-3a589e93a1ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420852, "uuid": "bac5126a-f350-4ace-81b6-c6a220f37d38", "value": "12288:at/nnvLHp6NU1jJAl94Ht+qE+jl6l2GRwLfQ90T:Invl6CD64N+q5jl6Rna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691420852, "uuid": "c46c2b57-8307-44f4-acd9-de1e9a7551fa", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691420852, "uuid": "1355bcd3-137d-4391-b4ef-d37160107b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420852, "uuid": "77c83b9a-a313-4d05-8765-40dcb0060eb5", "value": "DFLTianhui-Bulk-05-21-23-CPBU00712A23 & CPXD50013PACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0516d392-34bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691368834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691368834, "uuid": "2ccead93-3ec5-4428-97fd-7446237a1682", "comment": "Malware payload (RedLineStealer)", "value": "22fc9d30a5656ea499ebdb1db942240c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691368834, "uuid": "a44bb415-1058-4a3c-9ef2-15a7e6e94d79", "comment": "Malware payload (RedLineStealer)", "value": "d563a4a6cf56d316dc4898621b6547fc9b880d3126665a1fff5a97b9f00f7109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691368834, "uuid": "37c9bc81-0e00-4e64-b2d1-eeec8264fdf2", "comment": "Malware payload (RedLineStealer)", "value": "ba13b8f4f79550ec78a09b98a359903e72676349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691368834, "uuid": "64d9940f-e310-4d43-b1a7-ed75888566da", "comment": "Malware payload (RedLineStealer)", "value": "cf175f0e44b657e3f222f6cf2779d2e466020f0a2a5c12b4f582f6a4d356e25a358d175c4573d767395a3926dec3e9de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691368834, "uuid": "21ba95c7-8812-4eb3-890e-a4ea48cc3a06", "value": "T1F9862276727ACAE2C0554732B9929123373E9D727F170B7331B8361F0E723519AA92B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691368834, "uuid": "f1b47477-addf-4661-8b2c-5fe73c1905d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691368834, "uuid": "0debfc21-c3df-4142-b8cc-ce4b7988f4f4", "value": "98304:6/1FK8uWvXodPOTZgMVv2wNN/ZlFZIShcvsY8722fjHno4:6iavEmTZgMVvNvxXZdO5872Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691368834, "uuid": "c7669ff5-c29a-4bde-a13f-615d5e68d8f1", "value": 8217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691368834, "uuid": "e9401080-77df-4791-8f2c-7ca84c4721ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691368834, "uuid": "e7c50eb9-ef02-403b-befe-cd3e299aa4c7", "value": "22fc9d30a5656ea499ebdb1db942240c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f01339f-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691394781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394781, "uuid": "ac389a7e-a8a8-4117-a140-3b00c942f554", "comment": "Malware payload (DarkCloud)", "value": "272948798b8bc1a29a12540c95f33af2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394781, "uuid": "d4eec40a-761b-40c9-b8d8-81608bc2e56a", "comment": "Malware payload (DarkCloud)", "value": "d56fba09ff195114fdf8404435b83e2b9e49193e9e97afc3adef35610714462c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394781, "uuid": "e171cd3f-6f87-4a8d-9ea6-7f766ea8c9e8", "comment": "Malware payload (DarkCloud)", "value": "aca7653cb27251c980d52aa7243524e0a1fa96eb", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394781, "uuid": "752905e8-33e8-4f54-8584-4cb32bebfb7c", "comment": "Malware payload (DarkCloud)", "value": "dddbc060bfa43f73a0eb55b2a4637217682e5fa51e7a29b06db1fdfe8b21e6ffdca4fcdc4d2ea8bdb295768190b6d286", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394781, "uuid": "e1174912-f64d-4568-a065-61870c7a1dcc", "value": "T169A42926E611613EF563C8B1EAE5A25B58152D36268CEC5BF3914F0931312E3B8F532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394781, "uuid": "68fdac7b-7995-438d-9957-963c20ba8624", "value": "df409da21b629ca80732901d7c3584f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394781, "uuid": "f75106d6-e952-4ab1-80f5-5e57698e78bc", "value": "12288:pHJRZvjavHmXtYr90zzyDePuIjYKkJj6GmZU:3veazzEePu+Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394781, "uuid": "ad8e2fdb-7a99-45c7-8090-bfcc6c377a8f", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394781, "uuid": "2af2569f-28db-4fdc-82e0-4cf7681aa897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394781, "uuid": "7d98fdff-b90c-456f-8045-2af7d639efbb", "value": "d56fba09ff195114fdf8404435b83e2b9e49193e9e97afc3adef35610714462c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9338e94e-34c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691371649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691371649, "uuid": "520ce61f-92ed-44f2-a97c-a1b5e3a6eb3b", "comment": "Malware payload (AgentTesla)", "value": "31c1833ba2d08e1e55e6c94c94858f56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691371649, "uuid": "c436c2fc-5833-4d6a-9af8-e093a863b2a7", "comment": "Malware payload (AgentTesla)", "value": "d5a4870ee273b9e678077c354932bf5d7b1c5370b502afa440604614a1beca04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691371649, "uuid": "0ae424c0-b8f8-4c03-8d4f-03e817453bac", "comment": "Malware payload (AgentTesla)", "value": "100cb0b52986b5961fc82b6ac1600d0e77a33c83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691371649, "uuid": "4ff6ffdd-8fa7-4029-b332-7f5ce3b3cef3", "comment": "Malware payload (AgentTesla)", "value": "d76d102a391875e8457d4357e830a77a6ade890306e68abb9759fd6a26e30117a7eb35b4bea2ee8ca86b2b7a93b32d40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691371649, "uuid": "c279bef8-9637-4720-adfd-50cf91477253", "value": "T18F353921E77B655AEE29A5F88E1F803239D6D880F1B1C598B7E72C0385C23514E35BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691371649, "uuid": "69abe586-41c1-4ae3-8400-97ffa7c78a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691371649, "uuid": "36dda8d0-b057-411a-a129-61bab6a69910", "value": "24576:jZtYRtXt2PtRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOmOgu+5Y+QIXQ:jZtYRtXt2PtRs6CE3jLbO9Rs6CE3jLbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691371649, "uuid": "de41b5b9-0051-46e4-ae41-6534f28cbad9", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691371649, "uuid": "d0435477-39a6-4463-b8cb-b8bd02809c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691371649, "uuid": "5f85bbca-e7a7-4154-b1d1-c1d6b58c4890", "value": "SecuriteInfo.com.Trojan.PackedNET.2076.21454.31854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9569a97-350f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691405187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405187, "uuid": "3204c4f8-39fc-4817-a62a-f3466d5cd5a4", "comment": "Malware payload (DarkCloud)", "value": "de3a564b0d546edecbccb25298a8fd63", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405187, "uuid": "c7622fb4-304d-4ee1-bfb1-9f5f62db150a", "comment": "Malware payload (DarkCloud)", "value": "d69a6884ce826abeff346e7439fe7b96ba2303ed471f392ab8f98e71735383ec", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405187, "uuid": "530b65ed-5ad8-45ea-9962-c745d57a5f0a", "comment": "Malware payload (DarkCloud)", "value": "b247a04917534927da3b68c8ea6114de67e8194a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405187, "uuid": "5af1b2b4-1187-4901-909b-b991427aa350", "comment": "Malware payload (DarkCloud)", "value": "400646ed69234a7c5e946f714d74098889648d8c7922c8bc82e521b0883a58b475e73c40640e8114ae17741383640c35", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405187, "uuid": "eecdba66-6ca9-4afb-8e01-9b6dd3d91b2c", "value": "T181A42926EA51602EF153D8B1E9E4625B68196E7A169CEC2BF7855F0831312D3F8F031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405187, "uuid": "d68a5ea8-4549-4403-9934-8fcbfc839015", "value": "46dde7a8d2b198890050830beaf551ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405187, "uuid": "fc7fc2b8-72cd-450d-87ca-7531a0cbd291", "value": "12288:phrJddndm3AsXQJDKEKBBhtQHlfy9yECnjYKkJj6GmZU:dnwLNBBhtQH9/Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405187, "uuid": "32536e36-043f-4c86-ae0e-045f1b18a282", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405187, "uuid": "349f7d97-df6a-49f8-8ed5-3741da7b2578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405187, "uuid": "854fd82d-fee6-46ed-9ce0-29bf7fe8e695", "value": "d69a6884ce826abeff346e7439fe7b96ba2303ed471f392ab8f98e71735383ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd7a9fc-351e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BlankGrabber)", "timestamp": 1691411636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411636, "uuid": "36908da3-53dd-4283-b514-1ef2146a0bba", "comment": "Malware payload (BlankGrabber)", "value": "6317d4b61460ed1f0a0c121a9442e526", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411636, "uuid": "74c8a3c5-c9d6-47b7-ab5e-7d0aec27f7fd", "comment": "Malware payload (BlankGrabber)", "value": "d6ce0e4c972c3ccba5e782e65f800ef74cfb8ca03933cb31e2f328e000f1e410", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411636, "uuid": "3ddf09b5-4f0f-4949-b6f9-8519d63a4064", "comment": "Malware payload (BlankGrabber)", "value": "3e1bf31977a2c84ff7e3b27d19fa7a445c6210d0", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691411636, "uuid": "7bd24bd2-d17b-44c7-a562-3b066e6782d5", "comment": "Malware payload (BlankGrabber)", "value": "bfc4ae6f57a33f7b8c0fb110c76f4875daf122a057515800bdf66bc2206fdf600c73e306063ce5186d3291ef60ae037e", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411636, "uuid": "c584d4a9-e766-4dd0-a5e8-53b98bd058a0", "value": "T1FE76332A36272ECE8D41163670CF8570013DEBFE71AA5A465BE5944F7EB8E03EF29510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411636, "uuid": "62776c88-61fc-4952-b5fd-4823fc60c14b", "value": "196608:9+Yw6Fa8UluR6s5kbOs7jgHrN7sQHiWyOB5Nk0hhSEIdPUkTX:9+YwQnUluR95QOAmrNAQFyOdk+hSEIdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691411636, "uuid": "1a2061f3-0bd7-4032-97d0-37c500b10338", "value": 7235873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691411636, "uuid": "655e0eea-5843-470a-a305-6cb0460dea8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691411636, "uuid": "02bba5d9-9ba6-4b4c-900f-09bd7eb26ef3", "value": "sample (1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dd2b79-353b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691423829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423829, "uuid": "c46ac3a1-569f-48d3-894e-677c6e0e6c87", "comment": "Malware payload (Amadey)", "value": "aaf5a15859445d0df56f6cf12c3aba9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423829, "uuid": "aa4141d2-fa59-4aa5-b616-5d476df4399f", "comment": "Malware payload (Amadey)", "value": "d71dc328c34f1b787c326b6951b70637f9a264c3669ead012b8fae78ee62afab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423829, "uuid": "7c3e68b7-e8e1-4bf1-8487-85d19f99fe88", "comment": "Malware payload (Amadey)", "value": "6232dda7ff6e622191f5a3b3e078fd005ae77c89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423829, "uuid": "ce983e68-15a3-4e72-b8c3-1c9ce99336bc", "comment": "Malware payload (Amadey)", "value": "26a6e1fcb82f4bbd6a19ca7e1915f1543ffc7720692350d86f64bf740633e57d2f5385611f5d256a61e5c031cf7707a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423829, "uuid": "672b426d-7d50-4637-90e9-8900ae61aeb1", "value": "T16AC41202A7EC817BDAB913B068F702C30F36BDA05D78D3572389998B4D73690A975727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423829, "uuid": "4cb203b1-f374-4f68-8e49-997aa6696948", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423829, "uuid": "df04a24c-be13-4938-93c8-cc1f6e4263e2", "value": "12288:JMrCy90zqxBJiRKfR7yUysslNk+QEjm4nG+:byIrG7yUHgQz4n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691423829, "uuid": "ff37ff43-9486-4d0a-a984-fffef5f14049", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691423829, "uuid": "c6c336c5-1133-43e4-b2bc-4e613dbfd254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423829, "uuid": "2e935208-8223-4c0c-a09d-d6599e142514", "value": "aaf5a15859445d0df56f6cf12c3aba9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa32019-350d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691404178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404178, "uuid": "ea76ac9f-4081-4162-9ddf-c1e3e0a297a3", "comment": "Malware payload (AgentTesla)", "value": "f0f7734d6ce4d1e52d744398d3ab7a79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404178, "uuid": "21224354-afc0-46b3-ba96-89aa6c54050a", "comment": "Malware payload (AgentTesla)", "value": "d7489d5feb87a8745e90302a50876b8cacf396546c34877f5d346156f1e1f644", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404178, "uuid": "bfa15a3a-6b73-49c9-b501-b3911f6e0df4", "comment": "Malware payload (AgentTesla)", "value": "295b3d938e27a5fd44616dc648606a055a4665d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691404178, "uuid": "09bb204e-6572-4e61-91e6-d46201b3f347", "comment": "Malware payload (AgentTesla)", "value": "b34a9a32a5ee86f8a234c0952a49247d7401d8966cb761abf54f879d6980efa895f1e8a6d1f21940e97a9e1de0915c52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404178, "uuid": "9160b3ae-7134-48c4-8b66-73741e37a281", "value": "T1E2352821D7BB6446FF5AA3F84A2F4471B8D9E880F1F1D58963E6284394C2311CE25BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404178, "uuid": "f56eee54-3f0e-4205-b714-232989a01510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404178, "uuid": "d31cfb08-61f8-4c33-b050-3b8ef056d853", "value": "24576:SswcqQYK9zRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO4IOguz+0AUa+F:1Rs6CE3jLbO9Rs6CE3jLbO4Qua0rBDw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691404178, "uuid": "d48cc89d-6da0-4614-9783-b58a67847001", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691404178, "uuid": "297b7f48-8f2e-4fac-b591-2528a7abeab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691404178, "uuid": "fa02984f-9349-4542-b601-2e491368f435", "value": "SOA Toshiba.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c6660f-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691414689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414689, "uuid": "4cb256a8-a05f-42f0-9d0c-f418f4252a2c", "comment": "Malware payload (ModiLoader)", "value": "041d3a67322604929beb2b73561993bf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414689, "uuid": "ba5db00e-68fd-4478-b7cf-cd2c6e8f9188", "comment": "Malware payload (ModiLoader)", "value": "d815c085093b35ac977c206b6ea93dee817c02e926dd32768713b3a6bc7d1869", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414689, "uuid": "e7d5886f-ce37-446b-ab40-e68dd6afb0d8", "comment": "Malware payload (ModiLoader)", "value": "95a890a129aaec45060a626de8b1d5c14e8f80e2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414689, "uuid": "919649a7-5f44-4b35-bdf0-513785dc8561", "comment": "Malware payload (ModiLoader)", "value": "46e31c6045c45e24e3ffa644400b9fa1713c86f5117b66cff4a7fedacceafabdcc19536e562efe64c111c366161949ea", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414689, "uuid": "03eed74d-f2fb-4eca-8541-79803eb74f74", "value": "T1E725C026E6555572C42363789D4F6B988F2AFD306938B49136F8A9DC4EFB3803C6B113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414689, "uuid": "ffdc5ae2-147c-47e9-aa2a-4aa37099c71c", "value": "f124c2769d9b6924a548d49dbb0637ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414689, "uuid": "85359752-9b10-4efc-ac51-6acca6ffd684", "value": "12288:ahC5PdEN+Ff8tsq8BFhMw3iiKu0OnPbWfLFhLOrBZYiGJNraCknCPRe7Fly:hTLFf8tsq8HhMw3AuhnPbC6ZYimadE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414689, "uuid": "5187fd6a-981c-4286-afa4-be732934c275", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414689, "uuid": "0062bc7b-0b60-4cf7-a8d5-dee6b137e87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414689, "uuid": "71e820fd-8ed7-4e04-8e1f-530c2b9abb8a", "value": "HSBC Advice,pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f57d3e-357d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691452205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452205, "uuid": "4b9d378f-9344-4584-a3d6-14d6a110eef0", "comment": "Malware payload (Mirai)", "value": "a5a55c8b11b6d2aca6c02392889cc545", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452205, "uuid": "c8bfce00-a2d6-4acb-aaf2-dca2d020b2ee", "comment": "Malware payload (Mirai)", "value": "d8356254e573e9ffcad209f094d655eed73357bcdfafb95b603d2649ce9132b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452205, "uuid": "fe189c35-f7dd-4d5d-9e51-4f522a015987", "comment": "Malware payload (Mirai)", "value": "4af1a77eadbddc50cdc67715f4ae8cc0ee070870", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691452205, "uuid": "edd0c440-da86-47ca-8003-089f0f95163c", "comment": "Malware payload (Mirai)", "value": "08e03eb70714fa1cc3fd5f12b5b0c4fc7e6cebcc935274ad51576cf4feb560c788e0084a0eb342374664c4f929c9aac0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452205, "uuid": "cb6aa27a-53e5-44ed-85b8-09bd4c42813a", "value": "T15DE35C46EA818F13C4D5177AB9AF02893332A75493DB73069D146FB43FC6A6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452205, "uuid": "9a492bb7-8d63-4741-bea6-4e420a165ee5", "value": "3072:6Jc99Ahjp/4ceOtmdavC6L7NgMp8iEfNTKbl737xAZ65SLOfM/9MhLxh:6Jc99Ahjp/4ctmdaa6LNqTKbl73tAgS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691452205, "uuid": "780585d2-3cfa-4d97-a2ff-2d86dc8639b2", "value": 146299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691452205, "uuid": "7bb12a9e-1074-47ca-9fcb-256782bf4f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691452205, "uuid": "3156e9bd-8b72-4ac6-ba2b-097b93889cff", "value": "vcimanagement.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d1d1ac-34e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691386800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386800, "uuid": "42dafd72-851d-4498-851e-5eefdd865fc3", "comment": "Malware payload (Amadey)", "value": "cc7cc287d1211be9ed267e8596d06a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386800, "uuid": "6325c769-ae60-445e-8475-a1cdff465bb6", "comment": "Malware payload (Amadey)", "value": "da1a752980f464b0886544ec44ba3b9177ad5bd82547e8d99ca65d6a3ee91980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386800, "uuid": "67539e7a-c309-4c20-9944-ede83ff7068d", "comment": "Malware payload (Amadey)", "value": "fa8254ff30b1fea9c13ddf68d15ff46c2a7af4f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691386800, "uuid": "b9e3098d-a268-40a7-a131-f2e427d6e3ab", "comment": "Malware payload (Amadey)", "value": "0ec229f0f7959d421a66e070a806fb03111a0a645f98636ac1770a8664e8a44fb30e141862ae13fda01b5f963fa08a87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386800, "uuid": "97be9640-5e8d-4102-b217-48683f1963a7", "value": "T15ED5F7E1FE64CA03E45A3137C1AB0E7433A06C5306E1D62BAE6D735D8772772EC095A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386800, "uuid": "34208b35-5ad1-4e25-b9e5-7fe61a2913e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386800, "uuid": "91369816-83e9-4dc2-9f80-ed4614f6f755", "value": "24576:CCW3JNn9ecVyxxoL2J1tvgGrpNsUczRIRr82KGksz/4pJO5BMZOteAM2x3ET0dn:2Xnsx7tT6b2KGD/4pJOXMZ1jg0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691386800, "uuid": "eb2057f8-8173-415f-9f0f-a6d9a5a39225", "value": 2751320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691386800, "uuid": "cfefd1d1-2d0a-4565-825e-e5297d70d3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691386800, "uuid": "b9ac62a1-4da1-4ec6-968e-7ccc75750466", "value": "cc7cc287d1211be9ed267e8596d06a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a896ce87-356a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691444270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444270, "uuid": "d494e015-3de0-4ef0-894b-c65d5d678983", "comment": "Malware payload (AgentTesla)", "value": "12b32409dca8b9733e309bd6bd85e2d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444270, "uuid": "44afa5a0-e69a-4316-8841-593552a0451e", "comment": "Malware payload (AgentTesla)", "value": "dae4861f018c96cf3478fcfced5739252b356bbad416171afaf8cabc256283be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444270, "uuid": "f6b9366d-e939-426a-b330-7e5abe8ad5f5", "comment": "Malware payload (AgentTesla)", "value": "4b65f684b532a40ad89d8cf6bbe273768d2b83db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444270, "uuid": "13367a67-f60a-4006-8d27-1c801a1c429b", "comment": "Malware payload (AgentTesla)", "value": "350c5d179bb30c79a10e6797e59b44838a3401007ad1d14fec50237077bbec9e0eb864e324c0dcf960d141b58b7405cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444270, "uuid": "fb64f101-78e4-4e7e-9765-2cf7d3673e96", "value": "T1C64533B138765E40186BB20B51393718AA1CD8F7A70FF45896FE23630509CB9ADBD1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444270, "uuid": "bd395024-542f-452d-8ff8-1fe38cc11d59", "value": "24576:shnqsH6nDpuV+FE7tJ1xTi6uNv6agaj/pNcRvQ/yobhA:sVLanFE31xT06agG/pNUoqou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691444270, "uuid": "b7e1f93c-eb13-4598-870a-a42e7e9324d8", "value": 1166730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691444270, "uuid": "0afdb340-d9ed-4635-bf8b-cd317835dcae", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444270, "uuid": "1082e424-b860-483b-9612-231e896405b8", "value": "nQUOTATION_AUG7FIBA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a23118-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394799, "uuid": "2b04a969-4353-4f77-855d-6f2fa780df73", "comment": "Malware payload (AgentTesla)", "value": "e5207530a0a2fe78bd0c50a99bbf6807", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394799, "uuid": "ec2be753-d8c5-441d-88ca-327f7b432ba3", "comment": "Malware payload (AgentTesla)", "value": "db4d0d199912e16a125e5a2e2129e0eb18ed65cf774ed12652e128010fe31347", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394799, "uuid": "8f0e8fe0-5654-4f91-ab51-439fb38f99ca", "comment": "Malware payload (AgentTesla)", "value": "195652e85d79b8600d530b9e4da4f77493cce5f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394799, "uuid": "c3022ae2-16f3-4c14-8892-235a813b24a4", "comment": "Malware payload (AgentTesla)", "value": "89ecfdd8cf4c477fff89122205f834641031efa6c9cd17d2fdbcdd05fea30d92fa821d515de851a63126bdf12c06f21e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394799, "uuid": "be8bb958-0db2-42e0-9641-64115cb217f6", "value": "T1B2459303B9879DB2C1481737CED7149C63A0D7A17723E61A798FA35D0843FAA9B49327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394799, "uuid": "6c61ee58-9861-40fe-97ca-05e8832f918f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394799, "uuid": "92d705d4-3856-456a-b65b-f89afda358ec", "value": "24576:qR2f5rlRJK61D1o0xHhaWq01GWqHHqXrC36VO0lrp:qwHR8RI0Hqoir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394799, "uuid": "0ca7ae50-5856-4eb4-bb0f-8719739d3cf1", "value": 1252352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394799, "uuid": "f96cbd3c-c7ac-4ecd-a844-cfbceb6bff73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394799, "uuid": "ebf8d5ea-4d80-41c0-bd5c-70e08fc1b518", "value": "Skopje_doc534328900000000000000000000000002313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6aed467-34ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691398391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398391, "uuid": "ddb0c250-4400-4bde-98ab-28dd975b07cd", "comment": "Malware payload (DarkCloud)", "value": "9de989733d415c0d1944de60262d65a9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398391, "uuid": "777c1e68-4443-44f5-899b-d52ccb5b483b", "comment": "Malware payload (DarkCloud)", "value": "db8e8b79571753172812ca401f3baebabf3ddabd02c6be0dff616a618e06f783", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398391, "uuid": "1fa9bf5c-913b-4738-8db1-8ae6a06f844c", "comment": "Malware payload (DarkCloud)", "value": "5e0b7d3bdcd99580f158767af0408a42d6fb5aa1", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398391, "uuid": "9e011f25-e6aa-4d7b-8ff7-4cfda301e273", "comment": "Malware payload (DarkCloud)", "value": "b0aee5fb3c34c0cd8f738259902950bd57623ab370f00a5ff0ef15c70bcc90c67016b3e585462dbeade2e25c4349756c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398391, "uuid": "8f1ee611-4b70-42f0-affa-8d5819566063", "value": "T17AB40626E721702EE1EAC8F1E6E8526768146D761198E827F7C15F4D32352D3A8F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398391, "uuid": "8fd4467b-ec47-48ba-8da7-eaca81db3385", "value": "e54239e86b9cff7ce74afec114ce6400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398391, "uuid": "b63cb520-bddd-45e8-96f7-a23b5be29bdf", "value": "12288:t96BEnIHYA+2t3xny0I4d2Nqnp4vRqMr/jYKkJj6GmZU:WB0ZAcTInp4vcEYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691398391, "uuid": "387a819e-79c2-414c-ada3-b7669f254559", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691398391, "uuid": "22ff2c18-71b0-4d92-8e90-d9353d263a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398391, "uuid": "eb2525a0-1a8c-4b55-bccb-71a1f3f78b88", "value": "db8e8b79571753172812ca401f3baebabf3ddabd02c6be0dff616a618e06f783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1acc94-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691414208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414208, "uuid": "f591f622-eb14-4aac-a867-d716efae9b7a", "comment": "Malware payload (SnakeKeylogger)", "value": "a70aa9db141cac25a0ec2699e64d6e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414208, "uuid": "c9325cb1-6222-40fe-8b76-2e45cd9a3bde", "comment": "Malware payload (SnakeKeylogger)", "value": "ddc7d24e5b1c79a929518d52c3e769a434ad770c7282aa4e1c23ed78bad5a439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414208, "uuid": "32ff9399-4336-48b9-ad16-66e2c1d373f3", "comment": "Malware payload (SnakeKeylogger)", "value": "fdbeeab2fb8314c22c5bb88aa4811b2ece092bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414208, "uuid": "eba92425-aa87-474c-97d6-34fcc43391b1", "comment": "Malware payload (SnakeKeylogger)", "value": "732cb5533c79d918e80e70c6078aea1445421bc9254657a8e158e0c9d573a7d383bdd72afe6121b4c8b017ede478dddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414208, "uuid": "e7e839fa-11e3-468a-912a-e6d9ba82d71f", "value": "T1DA44F11934D5A55ED8D077F42E7085572AB6AC210034828FA7F8BF297A72263DDCE31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414208, "uuid": "7b9de0e5-dc0c-4dd1-bb06-4673deef2f0b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414208, "uuid": "a2760c6f-ddb2-4734-a238-54ec48e4ae8c", "value": "6144:gYa6NEVDjMetLU9CRnnnJoXwxptNsej3QHomCPJP31fHg5LXrRekMa:gY/6T4cnJogxptNH6qZFfAVlekMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414208, "uuid": "3ae0f641-33c7-4605-a2e2-be0ad75a6a60", "value": 263780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414208, "uuid": "b27c6914-7f9a-4385-abd4-335bbd47b57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414208, "uuid": "fbe72484-d020-414b-981f-3fe228a1b7a2", "value": "SHG0987654345780065FATU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b66f87-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691394784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394784, "uuid": "2124ebf1-d3ef-4222-8cac-6c500e7e073e", "comment": "Malware payload (Formbook)", "value": "fa30f2c3ae46b04496cdcea1d74e1971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394784, "uuid": "4b2699d0-ac64-433a-b16a-fe3506690061", "comment": "Malware payload (Formbook)", "value": "de16643e51e2e6e72c03e394fc0744beea0b1c480b138e2d687783a7da4d12e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394784, "uuid": "2068d36d-61a0-4964-9358-72e0cf557315", "comment": "Malware payload (Formbook)", "value": "336e16f5566dcb853d9fdbefd6a7db4a3158db5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394784, "uuid": "fe5ef3c5-30f8-41ba-9e7e-0b365b08a317", "comment": "Malware payload (Formbook)", "value": "8839a7ba7af11b646e83e1b464407496a54a5fcf7471acc9699d3edaa50cf1e0278531bbe7484e79df3fea3708fb2750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394784, "uuid": "92efd598-ca27-4bb5-b09d-3168d260aceb", "value": "T1D9E4E10572A99F97D07A83F90961A52017F46CAF1179E36DAEC2B0CE1A32F104E55F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394784, "uuid": "c9322e51-a1db-4e1b-9ad5-77481d6fdbdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394784, "uuid": "2897bf8e-6364-4a63-95f5-82d1a54ab6b3", "value": "12288:fQ4fTNZ2D2NUbb96H7b4mNw6jTvWZ6QvoWcm5gcr4Z:oWTvh/H34mNw6jTWZ6VFWrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394784, "uuid": "44ac77f4-de34-4668-a879-2599031b6070", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394784, "uuid": "ed581140-3db1-4080-ac7a-354d6b64422f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394784, "uuid": "24e32fd1-70ed-40a5-ab4a-acdadca15a8a", "value": "Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700b48a7-34c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691372449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372449, "uuid": "9af6aea5-778e-4005-98b2-68ad882be066", "comment": "Malware payload (Mirai)", "value": "938af6f778446c9b778869c6b484366a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372449, "uuid": "d6d28944-ea36-410c-a74c-e86442a97175", "comment": "Malware payload (Mirai)", "value": "deb1fc1cdac2e6a88d66deeee37a5a6c760ff0bb8d0f52b2773c920c00c271e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372449, "uuid": "b85474f8-26ab-469b-b8a6-826cbbddb573", "comment": "Malware payload (Mirai)", "value": "e86235b6f3b0c0522bc262bdd5b188b4d8d038d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691372449, "uuid": "89e3282d-c518-44d3-aa1e-02f85aee2c86", "comment": "Malware payload (Mirai)", "value": "694497bdf89efddb499581640d8ef7e81aae4434ac6ac5c6b12a9e9f6143066e16969a779c4f0694d6b12fcf5a508c74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372449, "uuid": "825e2626-a801-4547-a75c-fc47bf6017b2", "value": "T1BAD2E18C76D353E68CCDC97EB75E003A309A78E966B29323B305D4134775140E691E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372449, "uuid": "d7250b20-c078-422d-8bfd-0870c6cc9ecb", "value": "384:Mqd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKi1dHLpNy7:NlxKd29WcxEns+V6IHE4RlY990B147", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691372449, "uuid": "cb1a416a-5966-4bcf-b90d-d822cee85373", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691372449, "uuid": "ef906ace-3595-4a9d-b452-9ef6a892bb58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691372449, "uuid": "0d609e8f-e480-4776-8a12-3b4c1ca7645a", "value": "938af6f778446c9b778869c6b484366a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0388c664-3500-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691398467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398467, "uuid": "700b1968-f9eb-4f83-80dc-abc899bd0629", "comment": "Malware payload (DarkCloud)", "value": "8ba6a83381778a6c01205b35bc757f07", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398467, "uuid": "61ebddde-d9fe-4ead-985a-339e0cf98d63", "comment": "Malware payload (DarkCloud)", "value": "df25c2c52372d4f73007bb5207385b4ab8327d7bbfcc8b9661628963d37dd893", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398467, "uuid": "cce73afb-91e3-4919-a413-dff87197c703", "comment": "Malware payload (DarkCloud)", "value": "163b7efba67ddc0adf1da67353cd5250daf46b8a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691398467, "uuid": "b2a11eac-9795-45aa-9072-4e4ca2f071f4", "comment": "Malware payload (DarkCloud)", "value": "f8072017f3277fbd3e65a45403728b2daef158a331518a3db4eae7f17e095619a6b00e9318b2265a5cbe7bd7850fe2a7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398467, "uuid": "5a9a7f74-602b-4746-80fd-7cc322964224", "value": "T168A45D26EB61602EF063C8F1F5E5925768996D7A12A8AC27F7815F0935311D3E8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398467, "uuid": "81f3ea5c-ef06-4aa7-92d5-8dd1515403aa", "value": "1bda00bd756d4ff86cecf1c4d4088488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398467, "uuid": "f3aa78b7-5d55-4425-a815-4c7d0b127b04", "value": "12288:OVGVbzVTvd5/8xmIaCMBUt8ztJ0oKQiSjYKkJj6GmZU:7dViuztJ0oNxYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691398467, "uuid": "acf4de66-ebf8-4b2d-8073-1fb002f3a898", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691398467, "uuid": "8a8031f1-597b-4f17-8b85-87dda24eeb0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691398467, "uuid": "473000c9-499a-4b86-afd1-fa37a9e380b2", "value": "df25c2c52372d4f73007bb5207385b4ab8327d7bbfcc8b9661628963d37dd893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e297e083-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691414732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414732, "uuid": "7817a7e2-c3ac-469d-aa15-881b997d3bb0", "comment": "Malware payload (njrat)", "value": "3890b8381d0097b70797e484f40d0df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414732, "uuid": "5358cdfc-2595-4396-a839-7eba3de926a3", "comment": "Malware payload (njrat)", "value": "dfea487c68b65aafc445658ea66473de74997a46a9ebf5b0123d1031a2432305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414732, "uuid": "a95fc81f-8185-4af7-9719-feb8b3b25940", "comment": "Malware payload (njrat)", "value": "43f2196a11285902cab38264f64a0fd545161b44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414732, "uuid": "598b76d5-8511-46a8-acf3-654d761c97ac", "comment": "Malware payload (njrat)", "value": "8fbc6ae822681b49799df4eb32f4801bc5737039cebe50d4773765b6ad36441a87e54b47e4d03d72bbdf784b504c7f4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414732, "uuid": "3dd136ad-70da-4275-83ac-c08fd56ccc63", "value": "T13C46E046D2F68E27D38A1A3BA42515254231EE217B02B31F2B7D72797F733BA09053E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414732, "uuid": "cfc61c7d-0078-4319-80fc-1b74bf2ce10e", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414732, "uuid": "7c3b937e-d3be-4e30-b47f-94161fae43ee", "value": "98304:U98aK6oZt3D1RkS5OS0yionLTKnVhoDXDDm4O5DBur00H6qfe:yrK6oLD1GN3Xo6sDX3lUlY0Y6qfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414732, "uuid": "1586dcc6-1ee4-4f26-8ddb-763204e3a2a8", "value": 5677056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414732, "uuid": "b3ea2484-a73f-4a39-a0e2-04fd529003d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414732, "uuid": "40ec8875-6bad-4423-9b34-2e09412e7c82", "value": "3890b8381d0097b70797e484f40d0df3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ef41b7-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392728, "uuid": "c1f725f6-885a-4568-a6a9-090eb6d4380b", "comment": "Malware payload (Mirai)", "value": "ba6487edc973548ec4df81b0cd0c2af0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392728, "uuid": "7f08d710-d948-4998-8135-defb334aa747", "comment": "Malware payload (Mirai)", "value": "e1d89980757f6fc40144bc55d85957528ce43b72c86ba90da4f96c972ba5ec10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392728, "uuid": "053a22c2-4f00-4f20-88d5-bafe0e13d52d", "comment": "Malware payload (Mirai)", "value": "29c9ed2d7bb910df031f268355a5090a39a638e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392728, "uuid": "b8092dc4-ba12-4b75-bb24-1bd2200814b1", "comment": "Malware payload (Mirai)", "value": "07618a033716ec6949b1d4a4264ed5210f05589c53022e7565077e0a23c375f905642fcb541ae373b27f43ed34d04df2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392728, "uuid": "178cbe64-39ac-41a3-a7e9-d036ba0a1583", "value": "T17D43940ABF641EF7E86BCD3741A91B4534CD640A21E97FB66934D428FA1760F09E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392728, "uuid": "63306e35-9141-4cb1-8cc3-e123a15f9378", "value": "768:Lt8oEPwukTNN5HnIY0LwUZ2BzX7o4enreo8eBYyc7ZxFcXiqAXHqQ8V:Lt8oEPwucFGsUgt3OrV8KYyUZxF9HNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392728, "uuid": "590a2c97-e598-4c8b-8950-03cf6cfb0aa0", "value": 57064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392728, "uuid": "5868baa4-6213-4726-b9da-daf18f595dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392728, "uuid": "634ca049-b05f-4613-a95f-ee595a5c6537", "value": "ba6487edc973548ec4df81b0cd0c2af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c74c0b1-34fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691397810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397810, "uuid": "747d6a67-a2f9-4043-b383-68002403b056", "comment": "Malware payload (DarkCloud)", "value": "2921e78b4f515ed90e458bf0df09bd60", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397810, "uuid": "f08b6691-4e58-4bed-8db2-e8f1d916ff22", "comment": "Malware payload (DarkCloud)", "value": "e2156ff475b7949c41408fa558cb1db6fab7ea0d5696c3299d6d6ad9ff478bbf", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397810, "uuid": "48b8e24a-82f2-4272-ad79-a07af5e01dcd", "comment": "Malware payload (DarkCloud)", "value": "42ecfbe1008b45a9f6d26cff0dc4e9beff9cb3ff", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691397810, "uuid": "61ef0c35-e7a0-41e9-aa06-86fb02353e56", "comment": "Malware payload (DarkCloud)", "value": "c78ee4815e1d5367d3731b36396e9a5329717ffdfc83395789ea2c749745d78db2537c53d12804b92e5ea1e7d4603ff3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397810, "uuid": "fdda9bed-d90b-4fd8-939d-e7a56eddda2b", "value": "T1C7B40626E721702EE1EAC8F1E6E8526768146D761198E827F7C15F4D32352D3A8F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397810, "uuid": "9a393a1b-c035-489b-adb7-a6145f5ed13d", "value": "e54239e86b9cff7ce74afec114ce6400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397810, "uuid": "c72fef16-44b4-49bc-aa89-7ed13d0d9d07", "value": "12288:S96BEnIHYA+2t3xny0I4d2Nqnp4vRqMr/jYKkJj6GmZU:BB0ZAcTInp4vcEYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691397810, "uuid": "bdcb8cb0-29d1-4a21-98ea-110b5e9381fd", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691397810, "uuid": "0daf58a1-5615-4eda-8c05-ecc2ed3590d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691397810, "uuid": "2100f722-d957-4a88-8b29-159fb8c1879a", "value": "e2156ff475b7949c41408fa558cb1db6fab7ea0d5696c3299d6d6ad9ff478bbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5415275-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691414710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414710, "uuid": "604609ee-fd55-4a5e-b119-5a0c04433c6e", "comment": "Malware payload (RedLineStealer)", "value": "4568b08767d9667f6ba5961b347de76d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414710, "uuid": "5ddbc37b-dfe7-4afc-afe1-8d15dc9634f2", "comment": "Malware payload (RedLineStealer)", "value": "e228a849f5375edec8636a1c110c88169d7f8895cfe209eaf7e52d4f22cabeaa", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414710, "uuid": "4e9cc954-a759-4bf0-940c-1b760be9edea", "comment": "Malware payload (RedLineStealer)", "value": "e5b9e567cdd707024a15e02c55f27016f6466a50", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414710, "uuid": "af82aef0-79f9-4c51-8a4e-28fa81afe4da", "comment": "Malware payload (RedLineStealer)", "value": "670d64879312280ee6b4b80d5bb5584fec7984895051d0c50ed1dd468db5ae07cef6234ea78ade3a5c007a3a857e4e59", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414710, "uuid": "90eee717-ce14-4c0b-9306-0bf1888967ed", "value": "T16B2134040EF60724E7F3DB796DBAB31188367D05EE518FCD0240969D2824621E4B4F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414710, "uuid": "3b4719ea-66f5-4df5-9882-f0bc2f6aca31", "value": "24:8J/BHYVKVWl+/CWZ+OyfV3yrUMkWnFrabhHWAH:8x5aYydyrHPBagA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414710, "uuid": "e61b3466-f479-4835-a9cf-716b1ecd9bbd", "value": 1358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414710, "uuid": "b5d62873-1c49-4562-9f2c-04b4af2ef749", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414710, "uuid": "c1558c81-1f85-48fb-bc71-4fae6775fa0a", "value": "RFQ.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa56da7-3525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691414727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414727, "uuid": "4997637e-e3ef-4696-9c17-344b526a5a35", "comment": "Malware payload (AveMariaRAT)", "value": "3a859b46055fe33f985403419941dcc3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414727, "uuid": "50c1e401-640f-4f7b-a50c-5c21727e025a", "comment": "Malware payload (AveMariaRAT)", "value": "e25fd2085109b9daca4d45037febd515d325781a26a1cb2e6a8df985ebfe5e75", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414727, "uuid": "a77325da-23b1-425e-a910-13bd539385fb", "comment": "Malware payload (AveMariaRAT)", "value": "6c5a570f8596aa8fa219ce9bdc6ba16a9e766d4a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414727, "uuid": "f7807c85-4081-46b4-a6be-75a0909a4cc0", "comment": "Malware payload (AveMariaRAT)", "value": "eb8e372ee8464c45443fab6e57b557634bf7906ceca5078ec474a90d813c255b51ebf0600f05e96356b3cbdcf4f6bfca", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414727, "uuid": "0db69d8a-9f2a-4b2d-8bd8-3ee4f1f1254e", "value": "T127B5F503F6B6E5A2C1C59737C9D7041063E1DFA2A653DA0AA58B335509323BE4B8B773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414727, "uuid": "02a2c45f-df79-448d-9316-37ff510f2f93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414727, "uuid": "bfee2f47-c629-47aa-9bd6-920f5147ad5e", "value": "24576:hTXbs0cUYLFQmV7e8nVP2PxSVpZqAXJ/PoqDmu1o2gmnbd1yLjcw9dGop+KIg3UX:h82NEDymnbdDdlg3UIAKxZQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414727, "uuid": "b9e296a6-e67c-4181-a36e-234dff6be1d8", "value": 2346496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414727, "uuid": "85650605-c65d-4506-a539-5fde08fc1c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414727, "uuid": "ae7f82c1-630d-4bcb-888a-d61f7debd180", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3446a465-3558-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691436344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436344, "uuid": "6a826ff5-ab61-4348-b9e9-4f5e9df0b16a", "comment": "Malware payload", "value": "ef3a8fb13ca29ce0a09bf22c77d1cdd5", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436344, "uuid": "7b425ba9-203d-46e9-8da3-6b4518e58626", "comment": "Malware payload", "value": "e4205c486c62e31cfeabfe6a24cf7a94817e6b5ab21021dd9c23f8d738ec08d0", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436344, "uuid": "c2d29690-7170-448e-8c8b-285f938ebc26", "comment": "Malware payload", "value": "b0cfae03fbe5a79080ed9706685163fd337ebcd4", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691436344, "uuid": "a237586f-dede-44f5-87b7-25e6d76ac5ac", "comment": "Malware payload", "value": "2ed4c6e665865eec80fa365b6cc342b9930f89553056568c549fb9e4a8d1a826d3723b2f11d54d8927f6be9e71f72358", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436344, "uuid": "a7dcab59-858b-4a18-a645-3aaad3bd1b32", "value": "T12445DB38397A7C2443DBDA1334F14A961CE9564FD1703A3B199BD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436344, "uuid": "a7f7e497-2947-4a17-88b0-bb1e39c3756c", "value": "1536:3afu74uiYOObvL5XTeC7y9WLHAvOgtJWek9DL6dP9p1hsn6Wi8j+Im+lIWFTgJ0w:3374nYOObFTW9W0v/8eEqdPDZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691436344, "uuid": "96d6b477-5139-4fc3-9533-15f0ec337afb", "value": 1252361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691436344, "uuid": "35a04c1e-9ee7-46d9-a472-3b3651b250ed", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691436344, "uuid": "20aaed64-f3f0-4d28-b50d-82a4260bf03b", "value": "banner.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3e443a-356a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691444033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444033, "uuid": "d532e0f4-6c98-496c-9d65-60260193c53c", "comment": "Malware payload (GuLoader)", "value": "21cc7025dfd2e0f475cf3cb39e4b9005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444033, "uuid": "48bcd67d-6d64-4963-8520-1d9ca00d0ad3", "comment": "Malware payload (GuLoader)", "value": "e49fd2a82352a63a184372f5a71abf67cb1f9b709d4cf61d4de50194bdac57c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444033, "uuid": "a9f651f9-0d45-4e66-a8bf-2040a3896c90", "comment": "Malware payload (GuLoader)", "value": "725ff1d1817fb6b176384f8d6938c29aae519dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691444033, "uuid": "552c7e32-6a46-4916-a0cf-c19321941043", "comment": "Malware payload (GuLoader)", "value": "04022dd72878f6f50c1565cfa637cebedabc65ae93636cfc0e4fb88b3bb40092c8f08488e7a34343d0e4cc87180f716c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444033, "uuid": "5cf1a551-02b2-46a6-9e6f-7a544d29acdc", "value": "T148C412D0BFC0E5A7DD220936D7B6C6665236FD305C61C9C731893BAA8D31EA1C11A64F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444033, "uuid": "ecbda965-f05f-4148-80f6-667a45366301", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444033, "uuid": "c414fcd5-b3b1-4442-acc4-2da6d8b3ad5d", "value": "12288:AtHb13bWiceH9L6CLmeRfXnH9lXLwRg2IiX/Pcvu:MbNrcy9uRSPH9l7ig2I4c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691444033, "uuid": "6b167f17-0f9b-46c0-a02f-0af76dd0579f", "value": 572960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691444033, "uuid": "429cd5f8-7cb2-4e20-9d56-1abaa324cec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691444033, "uuid": "a4e6bc33-ccc4-4da1-9262-a1df0fa27956", "value": "rStorhertugs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31aed437-3534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691420878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420878, "uuid": "92c70d83-946e-43e7-82c2-7423ebb35e95", "comment": "Malware payload (GuLoader)", "value": "09816ab9ac411e6d4932b1edf9c14f78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420878, "uuid": "147107f4-98f0-413b-863a-a0579bed313a", "comment": "Malware payload (GuLoader)", "value": "e606474bf045b4c8133f5eb2d4b7eb15fa142a9b40fdf76a4dd72b68fa45e386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420878, "uuid": "1ff06bc1-ed26-479b-97ab-e5b800bdb9b5", "comment": "Malware payload (GuLoader)", "value": "bb17be2b8445741cc59f1dc1cf15c59af9a658d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691420878, "uuid": "b171d8b7-1a58-4af5-be93-90f1939d0dd4", "comment": "Malware payload (GuLoader)", "value": "b804568b8f9c0ac84d1f31f0570f8a546c059578d747492ad2c05cb98d93d133cd16624f4112ae483a6b7082c43a1e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420878, "uuid": "f529d6b8-8622-404e-9ed1-868ab7dcafe4", "value": "T1CEC4BE49E766ECE9FA260378257158263F419C5E61E8289D228DF7253C32313849BCFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420878, "uuid": "b8ad508a-ab65-4897-bdae-53ea4f71560c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420878, "uuid": "5583840f-2957-44ea-9ba2-1295d06c20d2", "value": "6144:6mOPluIv5WdShVkjR9rN/8IS+PAcxsZX777jKsU4k7vzvDlMh/BlU+qqlWog/:ChBvkzNkIdPAisZvvzTkn5Mh7woQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691420878, "uuid": "53b57a3d-6d70-49db-a604-59cd9623c36e", "value": 545992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691420878, "uuid": "0e9726ea-3548-45d3-a265-64fa40aa0f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691420878, "uuid": "71a169a0-4a68-490c-888a-0fd97121ea42", "value": "QUOTATION#6789034AUG23-INQUIRY_THANH PHUONG_INDUSTRIAL_TRADING_COMPANYs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231d73cd-34ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1691390359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390359, "uuid": "082c127d-f1c2-4aa7-a707-fbc093dbd45a", "comment": "Malware payload (AveMariaRAT)", "value": "67b2a4c3d5966c64d55785941997e486", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390359, "uuid": "956d9d26-e881-4e34-9380-1bf0b9bccd82", "comment": "Malware payload (AveMariaRAT)", "value": "e6b32540bfe545bb346386268359a906209cc80ff73d164ec9a33148019fe9e5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390359, "uuid": "593ab491-20f6-434c-892b-f15d09fc8c14", "comment": "Malware payload (AveMariaRAT)", "value": "d0f361be834f6106a894f970676d6a1c2235ad1c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691390359, "uuid": "ee31e0c8-3a1e-4054-a54f-006d3f4fdb8e", "comment": "Malware payload (AveMariaRAT)", "value": "9c0777d599728c0edf5f2ad9f7380e78708ef8a912b282546746797921d3a8fb11b3079abf71378e31cd84e8be5d9093", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390359, "uuid": "21052980-6933-4bf0-967f-9c8ae4d25f87", "value": "T1D184CE1AAEC311F4C0908874F7E960EE5AB5632F6506B7E7249816FAEF1671F34031B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390359, "uuid": "e16569ab-0307-46f5-a8d8-cb1f034f4ac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390359, "uuid": "d736f9c2-1d8c-472b-898d-f28f92664d53", "value": "3072:LZTNwme7IkrAsypLIDyimbNWo/KwlpVAX/JhkF/yAVO8h4KiM0074E2GXRtUTFWu:cme7WPpL6mbNWo3lIMFDXh4CF0Etm0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691390359, "uuid": "95cbd52e-c970-4666-98d2-c0c9ac220c2e", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691390359, "uuid": "19d1f1b1-a95c-4e32-ad6c-ab9151299e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691390359, "uuid": "09a7869a-7324-416b-aaaa-f84107492bfc", "value": "Revised Invoice No_8562023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83600695-34ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691377206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377206, "uuid": "bd45bf79-ffbd-4bca-be2a-b2a8bc872634", "comment": "Malware payload", "value": "9dbe4c8f520aca43ff2aebc1c3703a52", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377206, "uuid": "0633e255-89c0-411c-a9f8-2f6181d2d55f", "comment": "Malware payload", "value": "e6d75cd57f6d559851e9da904f6675c1bacb32040be3c15d43e2af9036d021d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377206, "uuid": "5b5a5cb9-c4f8-4809-b941-d7073204b9c3", "comment": "Malware payload", "value": "1f901a16816015eb33f77a3ca5d3d8d2566b28ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691377206, "uuid": "995214e0-a9a1-4392-ab88-39061dae4e35", "comment": "Malware payload", "value": "bab57267dd114bb84732766a4bbce86fde0f6eac60941fcb6e8341262e06acb0689416518e54400f8f42142b53ee6a9b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377206, "uuid": "b1cc2539-978c-44f0-a83b-8948fa327b6d", "value": "T1AAE32A46E7418B13C4D21B7AFBDB824533239B54D3E723065928BBF43F876AA4E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377206, "uuid": "1c206dc2-0051-45c7-b539-7d5e2ce83f0e", "value": "3072:or24/RpFNLRgasOyJM7svkeKC173XZofSITNfJM/9s5nM/:A/3FzgasOyJM7qkK1TXZRITNhM/9s5ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691377206, "uuid": "defa76e9-f628-4694-897b-3e25804623fa", "value": 147052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691377206, "uuid": "044d667d-3ab3-4c4f-8980-ef515aac703e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691377206, "uuid": "e3adce22-b1b8-4271-a0ea-571930285616", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499f53b8-3507-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691401591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401591, "uuid": "8ce4a886-7012-4f52-a3fc-1ad7945fcde1", "comment": "Malware payload (DarkCloud)", "value": "e7366803f7d1d7040ff12066087aa6f0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401591, "uuid": "60b31628-08e9-47b3-a4a6-ffba588d7de6", "comment": "Malware payload (DarkCloud)", "value": "e8291c052ab3f7f7fc0864cea66526f63f1fb8214a79a484cb826b627c02766d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401591, "uuid": "dcb61a9e-7eb6-4676-bc74-98ba2aaa3350", "comment": "Malware payload (DarkCloud)", "value": "f84d7808f25cf34a1a727aab657d24cbf2969efb", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691401591, "uuid": "b98fdce7-acf6-4f55-b052-a68715f990e5", "comment": "Malware payload (DarkCloud)", "value": "6cdc3e469e2355cdb7bb2c70eaf59cc3dfa0d2ab28be3fda41f987d8cded80f4d425965de4e46b7fd2df4a9704f088e8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401591, "uuid": "70c75240-b797-435f-8bd5-c32e27307af6", "value": "T12E844A12EA69703AF073C4F1AAB4922778156E362244E89BF3819F4A35355D7B4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401591, "uuid": "a5cdecc5-b1cf-4106-82df-a33e4d9ea1e1", "value": "9f29fcb360ef4784abc7f15a21685f98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401591, "uuid": "f060b7c3-cda0-4e29-87b0-d0d1cbbffc76", "value": "6144:Khys1IbodN72PILyf3D35jTS9F0aWbJR+af+lHlKYnUPJb6Hq8d1/w5KA81IJ8GR:Khys1Z0aWbJR+G+FAY+b2jYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691401591, "uuid": "0fcc70c0-ae9b-486f-897b-2091727ab86f", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691401591, "uuid": "aeac0b17-9d69-46cc-853c-f3aa3a38ad47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691401591, "uuid": "a83bf2f5-45d7-4e21-9ead-18db4502b205", "value": "e8291c052ab3f7f7fc0864cea66526f63f1fb8214a79a484cb826b627c02766d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd278cf7-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691395396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395396, "uuid": "380aee28-4bd9-4995-b5fe-459d889c5fcf", "comment": "Malware payload (Mirai)", "value": "03c84da83c28e725cec870190e5e4fbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395396, "uuid": "1c8627e9-e6d7-4d61-beba-d9818da7a770", "comment": "Malware payload (Mirai)", "value": "e9dbed5afbafdefb3648a7512e6ad450741adf10013b1fc5165da101dae23152", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395396, "uuid": "9327ed6b-4afc-4f03-94c5-64259ee63540", "comment": "Malware payload (Mirai)", "value": "9a56e3ace176a98608e75e61b3ccd14418bfe59e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395396, "uuid": "1e80ca5b-a79b-4631-821d-94b4c21320c1", "comment": "Malware payload (Mirai)", "value": "ebcff55b9dc30fa089dcea3dd1275c71ece14f819ae3db924977542f6edaec62f655df1223d19ebb19561421392948dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395396, "uuid": "705f526b-b0bb-4f9b-89ae-655f48311f0a", "value": "T117D2E12CD95DBE49CA6D3EB954CE9AF5384CB4C1635EE68E17238408F617A4BBC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395396, "uuid": "389354b8-b40b-496b-8d1b-97cb4a2e3f92", "value": "768:C1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNGObkLbSJb8WU6:CbDs06t4BEub4sU/MbUNkfSA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395396, "uuid": "507df033-4c8d-4623-86fa-7959a04d050f", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395396, "uuid": "74ecf8ac-2ba2-46fd-9584-b02423048e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395396, "uuid": "ee15b856-6bf6-4c4c-a5ce-40a39f8d7061", "value": "03c84da83c28e725cec870190e5e4fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55c260b-350b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1691403489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403489, "uuid": "6af53954-cf86-43cb-9ce0-ea8b9a13bc85", "comment": "Malware payload (STRRAT)", "value": "0ce4920c420eba27383996d5ef8b89ef", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403489, "uuid": "60100f50-f928-4eb9-814d-15d6cdbe9578", "comment": "Malware payload (STRRAT)", "value": "ed304d923a021a77847a171847346e55ee83a7b454c480bb5b4518a2cd0a9107", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403489, "uuid": "d3e0bb61-63c4-4471-90a4-78b7ff002617", "comment": "Malware payload (STRRAT)", "value": "32cf20539d95556ddcb87da67df37d2cfbf77bf0", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691403489, "uuid": "56f075e2-09f7-40ff-a193-27a13a50bf4f", "comment": "Malware payload (STRRAT)", "value": "120abff1e018eebe94a13d1d97c661d0c5c5722d827a325876a50ec2e45eab4a206a87041c2846aadddb84117cfea83e", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691403489, "uuid": "12052a9a-2004-4de2-9ee3-2067ed7f071e", "value": "T18924016ABEE7C4BAE04BCD375C01D223625C4B89D099A02F71FC294A5D75CA81356FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691403489, "uuid": "49932a6c-91d8-48f9-89b3-7deb2faa577b", "value": "6144:x8b4v2s7pRxCXj4Bo7LpEig2r5LnUrDomtorV8vtWWAG:x8c9DCTtS2lLnwGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691403489, "uuid": "afd3f279-5f0b-4392-a205-172b5e142bb9", "value": 214185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691403489, "uuid": "2991b403-0294-4e80-a64f-572a924922a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691403489, "uuid": "319adf5a-65e0-4459-ab45-28c08aaeae85", "value": "purchase order.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42d19b8-34f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691392750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392750, "uuid": "b1ceeb17-13bb-40a4-ab24-3fbd64e3e1d1", "comment": "Malware payload (Mirai)", "value": "8668f457da699047c5c169f77db1a979", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392750, "uuid": "024ac6fd-5cce-4cdb-aa11-a620faf4430b", "comment": "Malware payload (Mirai)", "value": "ee2d7ac43d4c69c3f8cb7de95de58105b49242e9410bd55a769199d49ba33831", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392750, "uuid": "80d9f044-f346-4d13-9e3b-31bef650b6ff", "comment": "Malware payload (Mirai)", "value": "fa381ce8614401a4b332b2dfc94790bde96bc528", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691392750, "uuid": "a518069e-adf2-467f-bc5b-21724ae656e0", "comment": "Malware payload (Mirai)", "value": "f808c199216c72f5a2391d65370813a269297182bab2dc63ea024cf0806f835a110bb7573850f7e5dc3c1548850a7a30", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392750, "uuid": "3a2b0481-06bb-4104-a603-db51e084cb20", "value": "T1121319136992C0FCC958C2305E7FA62AD533F07D6631FA9E33947F266E4AE201E0A585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392750, "uuid": "2ff203b1-d5e1-4228-a320-f24c4ca29df0", "value": "768:V7qL1+Jxf5kp/1lQgBcDNNyOq7KS33Vm02TKFVKWgva:QL0rkyguDLq7p33Vm0RVKWgva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691392750, "uuid": "e242a682-1e61-46b2-b079-2b95004b656f", "value": 42240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691392750, "uuid": "85c5e88d-7562-46ac-ac1c-d49e2c7a628d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691392750, "uuid": "c1579c32-6657-44b3-a1be-71588a470ccd", "value": "8668f457da699047c5c169f77db1a979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea3f07f-34d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691378916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378916, "uuid": "c149a79b-5050-4302-bd00-b90043de88c6", "comment": "Malware payload (AgentTesla)", "value": "382900b91b892429fda5b03e198b5ed9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378916, "uuid": "c75aa15c-0f24-47b4-b460-56e2a79ab012", "comment": "Malware payload (AgentTesla)", "value": "ef5087af3afc45066f1481f147c17a071bf985d8390c9770c07949101bbf239b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378916, "uuid": "f2747213-c856-4f10-959a-01881b3007d6", "comment": "Malware payload (AgentTesla)", "value": "64e1b587318ab70dc2ec46fc968cbb5bcf84c606", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691378916, "uuid": "0ab3442c-fac4-4fc0-a662-6d89a693556e", "comment": "Malware payload (AgentTesla)", "value": "c1f706046e04818c427815f5332f6c820f3ceed3600a1a7a4abe6038dfaf6c55fb17d5d2745db395a7f8a35f44c8761d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378916, "uuid": "1044acc9-0ef4-4d10-b96c-bb96898d8c11", "value": "T113151821E77B655AEE29A5F84E1F803239D6D8C0F1B1C598BBE7280385C23514E35BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378916, "uuid": "d2035a1f-bf8c-41d7-ac28-fef6f1266221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378916, "uuid": "d7a0dffd-301d-4990-85c0-dffbd5039748", "value": "24576:juUYxtHt2PfRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUODOgufMnuZs4b:juUYxtHt2PfRs6CE3jLbO9Rs6CE3jLbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691378916, "uuid": "e6b0b2c3-40b8-4726-8730-fb95de4790be", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691378916, "uuid": "579dea92-a586-48f9-ac0d-0fde90920898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691378916, "uuid": "33759cb9-5a51-4b09-8624-57e712898192", "value": "SecuriteInfo.com.Trojan.PackedNET.2076.15669.13730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476deca7-34df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691384407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384407, "uuid": "1f7e0280-d61b-4d48-b6df-e093db02c4f0", "comment": "Malware payload (Mirai)", "value": "4390e739b1c2155d32ecf20a10ec5f3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384407, "uuid": "8a849981-df37-4154-a0fc-f1c4b5b5bca1", "comment": "Malware payload (Mirai)", "value": "f095995a9b2f45fdeb4565fbe5b7ab79e7ed2306094e1a9be853bb1658b292bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384407, "uuid": "46a9df44-d5b2-401f-9f78-75d85b20eff6", "comment": "Malware payload (Mirai)", "value": "e44300f8864cfd9cde1fbb7732db13489887bb25", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691384407, "uuid": "bec11dc9-cfae-4dd5-b40b-6d283974f201", "comment": "Malware payload (Mirai)", "value": "2253417579d786b5e2aeb8ef53378a43c28f9ea7deef02feac4ed454a506675841188fdad49f14d29a537846471c18f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384407, "uuid": "cfc77b26-9d81-43b1-a726-fc10a7554e12", "value": "T1A6C32945FC508B17C6C612BBFB4E428D7B2A1758D3EE72039D256F61378B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384407, "uuid": "d038080a-5ead-4fd4-b596-133e85a9f2cc", "value": "1536:phtOK6rqhXRFOAKBc4Va2/sTgdEtaTvCU2EHgdllb2iwywrFv7s8WvtlaGKKO9jr:phukhFOc4pkMdEtazc6g3583T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691384407, "uuid": "f85ba947-98ed-4317-a97a-e81e26faaabc", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691384407, "uuid": "3ffbf337-f577-4605-b32a-15c608c688a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691384407, "uuid": "f3353404-ca1a-4037-8cd1-a5efaafca9e6", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b003578-351c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Metasploit)", "timestamp": 1691410612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410612, "uuid": "3ae23bbc-22fe-4260-a41d-822486fa0aac", "comment": "Malware payload (Metasploit)", "value": "a518f158dffac67e7f6040dc64e1a1af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410612, "uuid": "b56a0854-182c-4b7e-9abb-411606ed2b76", "comment": "Malware payload (Metasploit)", "value": "f1d7c05f16e266833f581fd1d8ba9f0dd2a66eeadf96d4a8726951663761343d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410612, "uuid": "e8d3a8cf-6522-4543-abe7-dd2f990bc493", "comment": "Malware payload (Metasploit)", "value": "3d8d1a87f36880224fc3878c1bb08b4d73121c05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410612, "uuid": "e6ceabd9-495f-4663-b680-4d4896c7cdca", "comment": "Malware payload (Metasploit)", "value": "4b9332b00306b490e34255c3f359c7fc4d4983b76708342d45a9492cfbf59afaaa2869c86cc0cceca9d663bd8fdb4c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410612, "uuid": "f90ab486-1761-432f-86a3-673e96a9c5ce", "value": "T188827A902DCE60DAF3334FB057D9B9BF0656F9B0192E31F87482498547A4989C8B2FB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410612, "uuid": "64198a96-1086-447e-8a82-76d4d2c6e9ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410612, "uuid": "6b2abff4-191e-46bc-919b-55addf0ce4a8", "value": "384:TgjcjwcOkjc5lPvL/c1fcVj8cp+YCzI2cl1caXUBcYxlkX3Jmwzup:Tgjcjwc1jc5B/c1fcVj8cMcl1caXQcFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691410612, "uuid": "b1db07f4-77a8-4d72-9fea-8662c6793456", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691410612, "uuid": "96fcc86a-9330-4551-a324-27eade6321a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410612, "uuid": "3002a2ee-ab89-4880-bce7-d36d27f0647a", "value": "f1d7c05f16e266833f581fd1d8ba9f0dd2a66eeadf96d4a8726951663761343d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe2545e-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691394783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394783, "uuid": "7225b6d5-b91e-4fa0-8650-62cd5264d38d", "comment": "Malware payload (DarkCloud)", "value": "95cc058ac2cc62daf7c46fad02a15232", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394783, "uuid": "1426fff1-5f6e-4ddf-acb6-1e7692c4dffa", "comment": "Malware payload (DarkCloud)", "value": "f59cbec7d435242c62ca7bbddd9e3dddbbba7c9131dc0268ccbfaeea07ddd363", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394783, "uuid": "84dfb527-d959-486d-b026-d6300226697c", "comment": "Malware payload (DarkCloud)", "value": "e0c2a7da6b0dacf3e36f22840c5aac5f34bfec68", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394783, "uuid": "627f7503-60dc-4840-8e1a-d627ddc0856e", "comment": "Malware payload (DarkCloud)", "value": "6a787162daf7ed78562ac258806efdbc1cf378b0f3eb914f46a2fb6bf41c13da83a3fd110e812b9f1d879d06d9cf8cdc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394783, "uuid": "b03a8d50-d6f1-4201-bf2f-5cf1ff799c22", "value": "T1E5A41816FA10712EF152C9F1E9D4D27768252D3611A8A8ABFBC15F4A31359D3A8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394783, "uuid": "66ceb280-7ac3-4acd-9af6-f754662b5e27", "value": "f04087517a52194138f935fd462dce1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394783, "uuid": "c458a1b3-c343-4a72-8d3d-5aefe9837ab6", "value": "12288:ZSmMj6NRC7oI/ItgP2xAOld+P4GiRGdJjYKkJj6GmZU:y6NwoM4d+P4GiR0xYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394783, "uuid": "55c49351-4a80-4de3-a9ce-af47129413a0", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394783, "uuid": "62d55bdf-b591-41b1-ae00-e9cd7ff675be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394783, "uuid": "02d85c53-563c-43b5-b670-f82c7b8b4723", "value": "f59cbec7d435242c62ca7bbddd9e3dddbbba7c9131dc0268ccbfaeea07ddd363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9adb04b-34f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691395390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395390, "uuid": "46e5372c-66b5-4551-8d6b-7d407bc746c5", "comment": "Malware payload (AgentTesla)", "value": "38425d156941ee415718b5f0fd7eb0e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395390, "uuid": "931d5c1c-90f6-4b8d-83f5-451238e7baf1", "comment": "Malware payload (AgentTesla)", "value": "f6c42a515a0e4f5a0be19b764ef25708eea3084ba1fc4de82e9ac440583d1165", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395390, "uuid": "6fa95fb1-8452-41df-a1e2-e4ec5e34d5c5", "comment": "Malware payload (AgentTesla)", "value": "2c993d1fa16d143c0e61a5e922c4c23f58b14afc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691395390, "uuid": "c2b280ae-c42c-4003-9d7b-296f39e7bcad", "comment": "Malware payload (AgentTesla)", "value": "b8e14b5774d215f79d0fe35e0e9a90ba096410fb70a783194276f9795647f96535fd1e5d6a4f7fa813332d7742763612", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395390, "uuid": "c50ec815-563c-45ab-9aaa-b12eb40ae3f0", "value": "T1398515027666CFA1D24F1776C19741B4036B9DC8EF96D7CB398A3E5A387A3AADC01107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395390, "uuid": "ab90902a-db84-42d2-bf69-297b907434ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395390, "uuid": "7012c21a-54d8-4c5f-b7e4-22fc2b7b8196", "value": "24576:tZTk8mOIAixgcPAPjl6RnuQ2MxNoE8i5jllhvLV//bbijF3J5CJu2w8IE/:rr0APKuhY5jllhzVHbbiH5CJAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691395390, "uuid": "fa5da55f-6d40-4754-8239-dc81aa87986f", "value": 1861832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691395390, "uuid": "127451ff-ab01-40ff-a284-2a7f1676a6c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691395390, "uuid": "f4dfbd6c-af49-4d1b-b82b-43c891c0d157", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0e96e0-3510-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691405623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405623, "uuid": "6c3274d5-166e-404b-b47b-566e3c74ff34", "comment": "Malware payload (AgentTesla)", "value": "82fcbe496291d81825ecf71472d3771d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405623, "uuid": "306dd303-7535-476b-8110-cbb8ad131c4b", "comment": "Malware payload (AgentTesla)", "value": "fc433b704d1378525e36f3f6cda5e1f0c19d3255eb8dafb32b5f62d3fcda3e2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405623, "uuid": "6a928ac8-9e2c-4d67-9dc3-a655e790d5a9", "comment": "Malware payload (AgentTesla)", "value": "bd5dd307da46bbb9ad5be4a963ba29f2ae4f7997", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405623, "uuid": "86d3ebdf-6298-4fcf-ac0e-068bfd50c27d", "comment": "Malware payload (AgentTesla)", "value": "d66244e72658adbaa65300d78be3058c9d355bca15e568478e5d638e0b887b2d09b73a43f0f6978951eeda26a8f1d009", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405623, "uuid": "a2536b32-49ca-4d7f-99ee-4e20e9b6eef9", "value": "T10E345A69B1C498E1D7AD0074D4FC419CCA72E0028B16EF5F1E9468FA3F567C3762ACA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405623, "uuid": "d039175f-529f-4632-ad2e-eb4e2bebcdaf", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405623, "uuid": "f696f9be-0d78-48a3-915a-abaeb7f7e1fc", "value": "6144:ADthOzj8zzKLGPXDpc+g++UobHzwvVeoPlX:AJkeBPXDpc+g++DzcVekX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405623, "uuid": "628d5507-a888-48ec-965a-7f1adee8cd75", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405623, "uuid": "7ad1df6f-b4a5-419e-b33c-27c27fc0a1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405623, "uuid": "5e7cabdc-ed74-4f64-b43e-88b5485400e4", "value": "fc433b704d1378525e36f3f6cda5e1f0c19d3255eb8dafb32b5f62d3fcda3e2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707745ca-34d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691381899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381899, "uuid": "9d25cfcc-2cd1-432a-bad3-90218c76b033", "comment": "Malware payload (Amadey)", "value": "f35036b3158786bd66d95fad2d89f8f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381899, "uuid": "437d2c41-223a-40c4-84c7-52e80e1680ac", "comment": "Malware payload (Amadey)", "value": "fd3e416a88031cdbb1de41a2363f8a828d2e4807226c229b65e5d3d9d040ce10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381899, "uuid": "4b399654-0219-4546-8e88-da5df358c550", "comment": "Malware payload (Amadey)", "value": "8e29f40b8334a0ba35333d525d7d9dc75315e44c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691381899, "uuid": "815479da-da81-413f-95ff-c95575752559", "comment": "Malware payload (Amadey)", "value": "2afd23fd2e399d6eebab780630480a0f84fb080205c5683e3b99368f3643ef4e6d0b198e0cb23b570033b23f23752a08", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381899, "uuid": "9639d57d-8cd7-4388-a3fe-bf5dee355925", "value": "T15AE41202EAFA9033C9B517B469F903C31B36BDA19C75873B2702951E0DB26D4997273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381899, "uuid": "52bd5f00-e739-49df-b532-2301e9c0cfb5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381899, "uuid": "1ffc14e3-ad8f-471f-8bfe-8af25e2bbec2", "value": "12288:AMrWy904G10Nf1DVUyUXf+T7X06zZHIeiMRlxC3ncH6JDnNZO47Ap+/w:GyBGS11DZUXfuX06zblxYQoZ1G+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691381899, "uuid": "d6dd19ec-416f-4187-8195-d90f27cac329", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691381899, "uuid": "88d16ef7-c421-42e6-845d-4acf594c689b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691381899, "uuid": "0cc891c6-8df1-4cf0-b5cf-f44f4b430c0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75999c84-34f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691394792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394792, "uuid": "d7292db5-ed71-4b9f-a763-e10ec37e3068", "comment": "Malware payload (AgentTesla)", "value": "54bfd5a4b69b2fc37bb621239da36f91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394792, "uuid": "47f9986e-0806-44d7-ba6b-776692855edf", "comment": "Malware payload (AgentTesla)", "value": "fe0dc5415b9e4a0aaab85349ca18704f10b02a3f5fe6de959b3e39d12a9a07a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394792, "uuid": "31636f6e-8ca5-41bb-80ab-4278b02cd297", "comment": "Malware payload (AgentTesla)", "value": "9c8ad37077f01b59d5a5c332ee7091904b9c8f9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691394792, "uuid": "767351da-af9a-4967-8e24-ad21fed32403", "comment": "Malware payload (AgentTesla)", "value": "6168980481590153f2af7e62454d3a68599d84f0a7673abe5b0a9011fc68dfbf356c20edb0469fcb9dee86500ed8e5c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394792, "uuid": "0fef19dc-167a-47f5-8478-4136441094e2", "value": "T146C412503AE8EB19FDED63B22C3D216E03F131584471E228AE566DD91575F8F9E02E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394792, "uuid": "942b98ae-1359-4479-9dc0-cf141845abff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394792, "uuid": "4cd49fe0-01bf-48dc-90c8-b5a1863ac851", "value": "12288:8LUsqVccCo65lAcQo0H8wk5RBf96rff6lZ2KGe:IUsqGcCP5l3QoewBl6W2Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691394792, "uuid": "6b478c41-4a91-4a14-928c-7ec94e31ba00", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691394792, "uuid": "c922bca6-2ea3-468f-af58-c8a1c5c59b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691394792, "uuid": "31eddb33-6594-43be-bf4e-4a5a8130648c", "value": "Original_Shipping Documents_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1681e91-3524-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691414220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414220, "uuid": "4be1bccf-e5a9-46e0-aa00-df0ad2b52de9", "comment": "Malware payload (SnakeKeylogger)", "value": "24af572a18b0c2490589745bc6466f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414220, "uuid": "3dc6fb83-cc5d-496d-a254-e9fe77fbef70", "comment": "Malware payload (SnakeKeylogger)", "value": "fe24a322c4104ce6fb8bc6b3460907471c999d6c1c87567648575034d3b67b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414220, "uuid": "968cc012-4a77-45c2-92c3-3181579f8a02", "comment": "Malware payload (SnakeKeylogger)", "value": "8c6064519e2ad1578741244a8d28ceb82983fbf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691414220, "uuid": "3d07b8f7-27b5-4f75-827c-4d09828d8515", "comment": "Malware payload (SnakeKeylogger)", "value": "a1e0de87d050d47584ac5bb61aec1c65bc5eaa43306e107f03c0cc8becdd2af9c458138d118545697a198f6f78c6b38e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414220, "uuid": "a97cc1db-3595-4aaa-bf24-1ed1ca7bc6c5", "value": "T183A4BE23715DE941C01A47765F3BA523E6286D097C31FACC248BF69A5BF1ED37012B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414220, "uuid": "69638eab-3d27-49cb-b7f8-83ec103d1705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414220, "uuid": "7a9162f4-12fe-4d68-8199-c19d6b84fe0e", "value": "12288:Scv6ZS2MRXplCmrHLedAEXeRD4gbtVEpp1y:Scy42GXpwmrH6dAEX9bn1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691414220, "uuid": "aef738be-e9d2-449e-aeaf-f46efd3ab1cb", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691414220, "uuid": "c1dcb06d-0ebd-4bd3-bb87-d243321051be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691414220, "uuid": "95a3b1b0-7e0a-4a7f-89fa-ecc78d738413", "value": "24af572a18b0c2490589745bc6466f3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a80897-351d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691410983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410983, "uuid": "9402f47c-95c0-4f85-9c5e-c39981f02ee0", "comment": "Malware payload", "value": "77421b1f90fc1e9247f693e857e8c429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410983, "uuid": "f4adb9a6-5828-4a37-9096-2765dc1b59e8", "comment": "Malware payload", "value": "feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410983, "uuid": "52d487dd-8d20-4981-9896-70952cf97a45", "comment": "Malware payload", "value": "63c26635980d5a185a24d1be79c877a1e8507133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691410983, "uuid": "93a05b16-fdf0-4d98-a24f-b6c78c383c51", "comment": "Malware payload", "value": "afa27d16d2409ee15d1c7ded4670c208ff0ab737b7b45497b041b062eaaf1f4a109470a272f6d2cd070aff1b4c235100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410983, "uuid": "dca728d1-6997-4b21-b365-b9bc3dd97eb0", "value": "T160C1400163E84266F1B30B30A9B307112AB5FA05AE77CB9F1984410F2D72F54CD63B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410983, "uuid": "50de04a7-f8fa-4705-a1d3-18f96cc416bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410983, "uuid": "72f52e75-58d6-4d7d-9fe4-7c4d98f21363", "value": "96:1jYUzP8hRH7AKjC2LcS14bqxqsmthY2VxEzNt:Fz8hRb1CNSGJsmjYSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691410983, "uuid": "4eb47e0f-1b24-45f1-9364-e643dbde2747", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691410983, "uuid": "31daad57-5f06-48d8-8049-5e04c2118cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691410983, "uuid": "26db8496-1791-4bd2-b263-da913f3766bb", "value": "feaf57c2993c580aa9d23610268ca0d88a7ca2f2294e54e11d95efb50a0858bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37973093-3511-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691405855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405855, "uuid": "43ba1a97-51bf-499d-bc63-8fc63e5a7408", "comment": "Malware payload (DarkCloud)", "value": "e2466447bc332f1ed71bd33602cd2366", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405855, "uuid": "f97b3975-3d64-45f3-afcd-bda08bd2a9b7", "comment": "Malware payload (DarkCloud)", "value": "ff83cbdb1e2d13c2b5b85bdbc2d87cfdfe96a115d97e4341024c7758747e80f1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405855, "uuid": "e97ffe7c-80e6-4e80-9b18-dfc4c148f489", "comment": "Malware payload (DarkCloud)", "value": "23d957c4c3165c54dae205976583615c9e594dd0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691405855, "uuid": "904ccc30-9601-4ff6-a0f7-ec5b1ef4d4b5", "comment": "Malware payload (DarkCloud)", "value": "9b810beef84527a120f6682aee8e8050544d0a3dd1243b22ef5131962bb6edc810e3969e5d14efc9938bdadcbb03a24d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405855, "uuid": "b13219a1-5300-4122-9ca5-e31451c3a656", "value": "T1E9A46C16EB61602EF053C8F1E6E5921768996D7A12A8EC27F7819F0935351D3E8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405855, "uuid": "b2f92d90-3e6b-4b0a-bb6d-66c022d242c0", "value": "2f4cc3406c48d1d30d3166cb5741eff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405855, "uuid": "bf4a67fc-a999-4673-803d-693a9111f6ad", "value": "12288:LEUH1n27bHqiAtweKISY2GFerjYKkJj6GmZU:Lp1vfKISY2GEXYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691405855, "uuid": "bd4d576d-25c4-4873-ac35-090982b29d9b", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691405855, "uuid": "cf0bf196-a10c-4f2e-ade7-7faa3d9adcb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691405855, "uuid": "8141756c-ed8e-4120-92e9-0b280ea49949", "value": "ff83cbdb1e2d13c2b5b85bdbc2d87cfdfe96a115d97e4341024c7758747e80f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c42f69-3541-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1691426497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426497, "uuid": "0d6e030f-53f1-43ca-9992-1ee2fe3787ee", "comment": "Malware payload (Arechclient2)", "value": "1c7a29f48b56d6e89620c0c55d515095", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426497, "uuid": "fbf0bb74-74b9-4e5a-a790-7b87f560e551", "comment": "Malware payload (Arechclient2)", "value": "ffd45c2b562d30113cb9a4823025a9a162503017e9d81fd96ddb5b98e5bb89bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426497, "uuid": "d10635fa-df27-4bb1-8c68-bd573a99c0ca", "comment": "Malware payload (Arechclient2)", "value": "6362eed3be15d632ce62400a159f483e1ffd7610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691426497, "uuid": "ac7569ba-0b90-4c62-969d-44f585ee44c2", "comment": "Malware payload (Arechclient2)", "value": "e49d6543855908a57d8e11a30824bc3be7ece09f5fd0b1297c856f888b025e32b0d1cfe0cfd443fa5dfc90e5fce6a899", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426497, "uuid": "6e3ecb19-c526-45cd-905f-f0be75eee551", "value": "T183E5334D32C176AAC097BEF40497C38673ED9D8C8BCC1A26391A2E1D1B747D49CA67C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426497, "uuid": "f3fa7497-8196-4fba-ace6-0ceab7e259ac", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426497, "uuid": "ceb0e5fe-842e-45cf-8bfc-81cdf7e9d816", "value": "98304:v6rcWNztTkmXubthKXwkgzdXqS/jwHxMz9IPctmZS:SrLNvubthKXxCaLM+Pctq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691426497, "uuid": "3c00fcaf-93dd-4890-8072-eb621a494ca8", "value": 3166208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691426497, "uuid": "4e5c669e-73c9-46f3-abe6-2a8c565144f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691426497, "uuid": "3e87dfd2-8236-4ba3-a5c3-20fb928be95d", "value": "1c7a29f48b56d6e89620c0c55d515095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0f3e66-353b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691423845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423845, "uuid": "f923923a-14ac-42ec-8b33-15e9eade98e1", "comment": "Malware payload", "value": "abfe26206d8a9ee68b52f4092367d619", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423845, "uuid": "f1fe24a7-3e33-46e9-be90-eaf82f211f7a", "comment": "Malware payload", "value": "ffdd76132e7d40db25dc202a7655eab2ba66cb3b509eb214ae6ec96b02352f38", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423845, "uuid": "f924fa37-b4e4-408b-885c-29a1d02a3457", "comment": "Malware payload", "value": "08ebfd062dcaf9d2e1469f49bb03c93c966de968", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691423845, "uuid": "9e552cc7-838b-4927-9bf4-aecb1b405864", "comment": "Malware payload", "value": "1fe815ac03bc849bb1182df1fd4a23395dfd69521d25c703663ff0084f08d8324b40a29b30c833e85d72bacb69123091", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423845, "uuid": "0971aa2e-4ea7-474d-9105-2b738b9a1fea", "value": "T1906498BA6076FE8686370981E1043F179C298EDF6A7847F877C411D1C19CA8CA9E75F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423845, "uuid": "7ef50a5f-108a-46fd-89a6-30ed3fe32b88", "value": "3072:YjiWmNMYzPVW1rckgRi99aD5RksXJWLviCL6Ct4jSk7ID2Pv8sDt8Dk+f9RFSUoH:LNNW1rBmK98ELvi6As93CKGZk5eoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691423845, "uuid": "76db0d75-6f78-423b-b1d0-65e8a7e11cbf", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691423845, "uuid": "1a995fcc-b69e-4846-b6f2-5c1ff23790aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691423845, "uuid": "71f41b6f-402c-4d09-ba65-831d39e98507", "value": "nbvzfip.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }